diff --git a/README.md b/README.md index 1c4b42f2e0..87c4b6c262 100644 --- a/README.md +++ b/README.md @@ -30,7 +30,7 @@ Create your customized version of Security Content by forking this project and f # MITRE ATT&CK ### Detection Coverage -To view an up-to-date detection coverage map for all the content tagged with MITRE techniques visit: [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/) under the **Detection Coverage** layer. Below is a snapshot in time of what we are covering. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security-content/blob/mitre_maps/bin/generate-coverage-map.py). +To view an up-to-date detection coverage map for all the content tagged with MITRE techniques visit: [https://mitremap.splunkresearch.com/](https://mitremap.splunkresearch.com/) under the **Detection Coverage** layer. Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security-content/blob/mitre_maps/bin/generate-coverage-map.py). ![](docs/mitre-map/coverage.png) diff --git a/bin/generate-actors-map.py b/bin/generate-actors-map.py index 0a31b505c9..936b7c0bbb 100644 --- a/bin/generate-actors-map.py +++ b/bin/generate-actors-map.py @@ -20,8 +20,8 @@ def main(argv): # parse input variables parser = argparse.ArgumentParser(description='Detection Priority based on APT groups') - parser.add_argument('--projects_path', default='.', action='store', metavar='N', help='folder containing the projects Mitre Cyber Threat Intelligence Repository, Security Content and Sigma') - parser.add_argument('--output', default='output', action='store', help='result output directory, defaults to output') + parser.add_argument('-p', '--projects_path', default='.', action='store', metavar='N', help='folder containing the projects Mitre Cyber Threat Intelligence Repository, Security Content and Sigma') + parser.add_argument('-o', '--output', default='output', action='store', help='result output directory, defaults to output') cmdargs = parser.parse_args() print("get all techniques for group") @@ -45,6 +45,7 @@ def main(argv): def count_techniques(techniques, all_techniques): counted_techniques = [] + final_counted_techniques = [] max_count = 0 actors = [] @@ -54,7 +55,15 @@ def count_techniques(techniques, all_techniques): counted_techniques.append({'name': all_technique['name'], 'object': all_technique, 'count': count_technique}) max_count = count_technique if count_technique > max_count else max_count - counted_techniques = sorted(counted_techniques, key = lambda i: i['count'], reverse=True) + for all_technique in all_techniques: + if "." in all_technique["external_references"][0]["external_id"]: + parent_id = all_technique["external_references"][0]["external_id"].split(".")[0] + for counted in counted_techniques: + if parent_id == counted["object"]["external_references"][0]["external_id"]: + counted['count'] += 1 + final_counted_techniques.append(counted) + + counted_techniques = sorted(final_counted_techniques, key = lambda i: i['count'], reverse=True) return counted_techniques, max_count @@ -131,13 +140,16 @@ def generate_navigator_layer(matched_techniques, max_count, output): for technique in matched_techniques: comments = [] + layer_technique = { + "techniqueID": technique["ID"], + "score" : technique["score"], + "showSubtechniques": True + } + + if len(technique["splunk_rules"]) > 0: for splunk_rule in technique["splunk_rules"]: comments.append("https://github.com/splunk/security-content/blob/develop/detections/" + splunk_rule['filename']) - layer_technique = { - "techniqueID": technique["ID"], - "score" : technique["score"] - } if len(comments) > 0: layer_technique["comment"] = "\n\n".join(comments) diff --git a/bin/generate-coverage-map.py b/bin/generate-coverage-map.py index 8a51cb3700..1229816b4a 100644 --- a/bin/generate-coverage-map.py +++ b/bin/generate-coverage-map.py @@ -20,14 +20,14 @@ def main(argv): # parse input variables parser = argparse.ArgumentParser(description='Detection Coverage') - parser.add_argument('--projects_path', default='.', action='store', metavar='N', help='folder containing the projects Mitre Cyber Threat Intelligence Repository, Security Content and Sigma') - parser.add_argument('--output', default='output', action='store', help='result output directory, defaults to output') + parser.add_argument('-p', '--projects_path', default='.', action='store', metavar='N', help='folder containing the projects Mitre Cyber Threat Intelligence Repository, Security Content and Sigma') + parser.add_argument('-o', '--output', default='output', action='store', help='result output directory, defaults to output') cmdargs = parser.parse_args() print("get all techniques") techniques = get_all_techniques(cmdargs.projects_path) - print("count techniques") + print("load detections") detections = load_objects(path.join(cmdargs.projects_path),'detections/*.yml') print("get matched techniques") @@ -45,6 +45,7 @@ def main(argv): def count_detections(matched_techniques): scored_detections = [] + final_scored_detections = [] max_count = 0 for technique in matched_techniques: @@ -52,7 +53,16 @@ def count_detections(matched_techniques): technique['score'] = len(technique['splunk_rules']) max_count = technique['score'] if technique['score'] > max_count else max_count scored_detections.append(technique) - return scored_detections, max_count + + for technique in matched_techniques: + if "." in technique['ID']: + parent_id = technique['ID'].split(".")[0] + for scored in scored_detections: + if parent_id == scored['ID']: + scored['score'] += len(technique['splunk_rules']) + final_scored_detections.append(scored) + + return final_scored_detections, max_count def get_all_techniques(projects_path): @@ -108,6 +118,7 @@ def generate_navigator_layer(matched_techniques, max_count, output): layer_technique = { "techniqueID": technique["ID"], "score" : technique["score"] + } else: layer_technique = {} @@ -120,11 +131,12 @@ def generate_navigator_layer(matched_techniques, max_count, output): # ranging from zero (white) to the maximum score in the file (red) layer_json["gradient"] = { "colors": [ - "##ffffff", - "#8ec843" + "#ffffff", + "#66b1ff", + "#096ed7" ], "minValue": 0, - "maxValue": 0 + "maxValue": max_count } layer_json["filters"] = { @@ -146,8 +158,8 @@ def generate_navigator_layer(matched_techniques, max_count, output): "color": "#ffffff" }, { - "label": "Available detections", - "color": "#8ec843" + "label": "Some detections available", + "color": "#66b1ff" } ] diff --git a/deployments/11_detect_arp_poisoning.yml b/deployments/11_detect_arp_poisoning.yml new file mode 100644 index 0000000000..669772a8e8 --- /dev/null +++ b/deployments/11_detect_arp_poisoning.yml @@ -0,0 +1,22 @@ +name: Detect ARP Poisoning deployment configuration +id: e1d5b4dc-4cf3-404f-905c-b478bbb20474 +date: '2020-08-14' +description: This configuration file applies to the Detect ARP Poisoning detection +author: Mikael Bjerkeland +scheduling: + cron_schedule: '59 * * * *' + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto +alert_action: + notable: + rule_description: 'ARP Poisoning has been detected on interface $src_interface$ on host $orig_host$. + This may be an indication of a MITM attack.' + rule_title: 'ARP Poisoning Detected on $orig_host$' + nes_fields: + - src_interface + - firstTime + - lastTime + - count +tags: + detection_name: Detect ARP Poisoning diff --git a/deployments/12_detect_dhcp_poisoning.yml b/deployments/12_detect_dhcp_poisoning.yml new file mode 100644 index 0000000000..a01cdc431d --- /dev/null +++ b/deployments/12_detect_dhcp_poisoning.yml @@ -0,0 +1,23 @@ +name: Detect Rogue DHCP Server deployment configuration +id: 6e4e20ac-e719-4ebe-a52d-d672cd451dbb +date: '2020-08-14' +description: This configuration file applies to the Detect Rogue DHCP Server detection +author: Mikael Bjerkeland +scheduling: + cron_schedule: '59 * * * *' + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto +alert_action: + notable: + rule_description: 'DHCP Snooping has detected a Rogue DHCP Server on $orig_host$ from $src_mac$. + This may be an indication of a MITM attack.' + rule_title: 'Rogue DHCP Server Detected on $orig_host$' + nes_fields: + - src_mac + - firstTime + - lastTime + - count + - message_type +tags: + detection_name: Detect Rogue DHCP Server diff --git a/detections/aws_detect_permanent_key_creation.yml b/detections/aws_detect_permanent_key_creation.yml index 7a87ba7621..5637090c3d 100644 --- a/detections/aws_detect_permanent_key_creation.yml +++ b/detections/aws_detect_permanent_key_creation.yml @@ -6,7 +6,7 @@ id: 12d6d713-3cb4-4ffc-a064-1dca3d1cca01 known_false_positives: "Not all permanent key creations are malicious. If there is a policy of rotating keys this search can be adjusted to provide better context." name: "aws detect permanent key creation" references: [] -search: '`aws_cloudwatchlogs_eks` AKIA | spath eventName | search eventName=CreateAccessKey "userIdentity.type!=AssumedRole" | table sourceIPAddress userName src_user userIdentity.type userAgent action status responseElements.accessKey.createDate responseElements.accessKey.status responseElements.accessKey.accessKeyId +search: '`aws_cloudwatchlogs_eks` CreateAccessKey | spath eventName | search eventName=CreateAccessKey "userIdentity.type"=IAMUser | table sourceIPAddress userName userIdentity.type userAgent action status responseElements.accessKey.createDate responseElements.accessKey.status responseElements.accessKey.accessKeyId |`aws_detect_permanent_key_creation_filter`' tags: analytics_story: diff --git a/detections/detect_arp_poisoning.yml b/detections/detect_arp_poisoning.yml new file mode 100644 index 0000000000..2a447af268 --- /dev/null +++ b/detections/detect_arp_poisoning.yml @@ -0,0 +1,48 @@ +name: Detect ARP Poisoning +id: b44bebd6-bd39-467b-9321-73971bcd7aac +version: 1 +date: '2020-08-11' +description: By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organization's + network devices, we will be able to detect ARP Poisoning attacks in the Infrastructure. +how_to_implement: This search uses a standard SPL query on logs from Cisco Network + devices. The network devices must be configured with DHCP Snooping + (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html) + and Dynamic ARP Inspection + (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-2_2_e/security/configuration_guide/b_sec_1522e_2960x_cg/b_sec_1522e_2960x_cg_chapter_01111.html) + and log with a severity level of minimum "5 - notification". + The search also requires that the Cisco Networks Add-on for Splunk + (https://splunkbase.splunk.com/app/1467) is used to + parse the logs from the Cisco network devices. +type: ESCU +references: [] +author: Mikael Bjerkeland, Splunk +search: '`cisco_networks` facility="PM" mnemonic="ERR_DISABLE" disable_cause="arp-inspection" + | eval src_interface=src_int_prefix_long+src_int_suffix + | stats min(_time) AS firstTime max(_time) AS lastTime count + BY host src_interface + | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`| + `detect_arp_poisoning_filter`' +known_false_positives: This search might be prone to high false positives if + DHCP Snooping or ARP inspection has been incorrectly configured, + or if a device normally sends many ARP packets (unlikely). +tags: + analytics_story: + - Router and Infrastructure Security + kill_chain_phases: + - Reconnaissance + - Delivery + - Actions on Objectives + mitre_attack_id: + - T1200 + - T1498 + - T1557 + cis20: + - CIS 1 + - CIS 11 + nist: + - ID.AM + - PR.DS + detection_name: Detect ARP Poisoning + security_domain: network + asset_type: Infrastructure + diff --git a/detections/detect_gcp_storage_access_from_a_new_ip.yml b/detections/detect_gcp_storage_access_from_a_new_ip.yml new file mode 100644 index 0000000000..ab57ad4e4b --- /dev/null +++ b/detections/detect_gcp_storage_access_from_a_new_ip.yml @@ -0,0 +1,48 @@ +name: Detect GCP Storage access from a new IP +id: ccc3246a-daa1-11ea-87d0-0242ac130022 +version: 1 +date: '2020-08-10' +description: This search looks at GCP Storage bucket-access logs and detects new or previously + unseen remote IP addresses that have successfully accessed a GCP Storage bucket. +how_to_implement: This search relies on the Splunk Add-on for Google Cloud Platform, setting up a Cloud Pub/Sub input, along with the relevant GCP PubSub topics and logging sink to capture GCP Storage Bucket events (https://cloud.google.com/logging/docs/routing/overview). In order to capture public GCP Storage Bucket access logs, you must also enable storage bucket logging to your PubSub Topic as per https://cloud.google.com/storage/docs/access-logs. These logs are deposited into the nominated Storage Bucket on an hourly basis and typically show up by 15 minutes past the hour. It is recommended to configure any saved searches or correlation searches in Enterprise Security to run on an hourly basis at 30 minutes past the hour (cron definition of 30 * * * *). A lookup table (previously_seen_gcp_storage_access_from_remote_ip.csv) stores the previously seen access requests, and is used by this search to determine any newly seen IP addresses accessing the Storage Buckets. +type: ESCU +references: [] +author: Shannon Davis, Splunk +search: '`google_gcp_pubsub_message` +| multikv +| rename sc_status_ as status +| rename cs_object_ as bucket_name +| rename c_ip_ as remote_ip +| rename cs_uri_ as request_uri +| rename cs_method_ as operation +| search status="\"200\"" +| stats earliest(_time) as firstTime latest(_time) as lastTime by bucket_name remote_ip operation request_uri +| table firstTime, lastTime, bucket_name, remote_ip, operation, request_uri +| inputlookup append=t previously_seen_gcp_storage_access_from_remote_ip.csv +| stats min(firstTime) as firstTime, max(lastTime) as lastTime by bucket_name remote_ip operation request_uri +| outputlookup previously_seen_gcp_storage_access_from_remote_ip.csv +| eval newIP=if(firstTime >= relative_time(now(),"-70m@m"), 1, 0) +| where newIP=1 +| eval first_time=strftime(firstTime,"%m/%d/%y %H:%M:%S") +| eval last_time=strftime(lastTime,"%m/%d/%y %H:%M:%S") +| table first_time last_time bucket_name remote_ip operation request_uri +| `detect_gcp_storage_access_from_a_new_ip_filter`' +known_false_positives: GCP Storage buckets can be accessed from any IP (if the ACLs are open to allow it), + as long as it can make a successful connection. This will be a false postive, since the search is looking + for a new IP within the past two hours. +tags: + analytics_story: + - Suspicious GCP Storage Activities + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1530 + cis20: + - CIS 13 + - CIS 14 + nist: + - PR.DS + - PR.AC + - DE.CM + security_domain: network + asset_type: GCP Storage Bucket \ No newline at end of file diff --git a/detections/detect_new_open_gcp_storage_buckets.yml b/detections/detect_new_open_gcp_storage_buckets.yml new file mode 100644 index 0000000000..50987b2983 --- /dev/null +++ b/detections/detect_new_open_gcp_storage_buckets.yml @@ -0,0 +1,39 @@ +name: Detect New Open GCP Storage Buckets +id: f6ea3466-d6bb-11ea-87d0-0242ac130003 +version: 1 +date: '2020-08-05' +description: This search looks for GCP PubSub events where a user has created an open/public GCP Storage bucket. +how_to_implement: 'This search relies on the Splunk Add-on for Google Cloud Platform, setting up a Cloud Pub/Sub input, along with the relevant GCP PubSub topics and logging sink to capture GCP Storage Bucket events (https://cloud.google.com/logging/docs/routing/overview).' +type: ESCU +references: [] +author: Shannon Davis, Splunk +search: '`google_gcp_pubsub_message` data.resource.type=gcs_bucket data.protoPayload.methodName=storage.setIamPermissions +| spath output=action path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.action +| spath output=user path=data.protoPayload.authenticationInfo.principalEmail +| spath output=location path=data.protoPayload.resourceLocation.currentLocations{} +| spath output=src path=data.protoPayload.requestMetadata.callerIp +| spath output=bucketName path=data.protoPayload.resourceName +| spath output=role path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.role +| spath output=member path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.member +| search (member=allUsers AND action=ADD) +| table _time, bucketName, src, user, location, action, role, member +| search `detect_new_open_gcp_storage_buckets_filter`' +known_false_positives: While this search has no known false positives, it is possible + that a GCP admin has legitimately created a public bucket for a specific purpose. + That said, GCP strongly advises against granting full control to the "allUsers" + group. +tags: + analytics_story: + - Suspicious GCP Storage Activities + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1530 + cis20: + - CIS 13 + nist: + - PR.DS + - PR.AC + - DE.CM + security_domain: network + asset_type: GCP Storage Bucket \ No newline at end of file diff --git a/detections/detect_rogue_dhcp_server.yml b/detections/detect_rogue_dhcp_server.yml new file mode 100644 index 0000000000..afd91c41ed --- /dev/null +++ b/detections/detect_rogue_dhcp_server.yml @@ -0,0 +1,45 @@ +name: Detect Rogue DHCP Server +id: 6e1ada88-7a0d-4ac1-92c6-03d354686079 +version: 1 +date: '2020-08-11' +description: By enabling DHCP Snooping as a Layer 2 Security measure on the organization's + network devices, we will be able to detect unauthorized DHCP servers handing out DHCP + leases to devices on the network (Man in the Middle attack). +how_to_implement: This search uses a standard SPL query on logs from Cisco Network + devices. The network devices must be configured with DHCP Snooping enabled + (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html) + and log with a severity level of minimum "5 - notification". + The search also requires that the Cisco Networks Add-on for Splunk + (https://splunkbase.splunk.com/app/1467) is used to + parse the logs from the Cisco network devices. +type: ESCU +references: [] +author: Mikael Bjerkeland, Splunk +search: '`cisco_networks` facility="DHCP_SNOOPING" mnemonic="DHCP_SNOOPING_UNTRUSTED_PORT" + | stats min(_time) AS firstTime max(_time) AS lastTime count values(message_type) AS + message_type values(src_mac) AS src_mac BY host + | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`| + `detect_rogue_dhcp_server_filter`' +known_false_positives: This search might be prone to high false positives if + DHCP Snooping has been incorrectly configured or in the unlikely event that + the DHCP server has been moved to another network interface. +tags: + analytics_story: + - Router and Infrastructure Security + kill_chain_phases: + - Reconnaissance + - Delivery + - Actions on Objectives + mitre_attack_id: + - T1200 + - T1498 + - T1557 + cis20: + - CIS 1 + - CIS 11 + nist: + - ID.AM + - PR.DS + detection_name: Detect Rogue DHCP Server + security_domain: network + asset_type: Infrastructure diff --git a/docs/mitre-map/coverage.csv b/docs/mitre-map/coverage.csv index 4e2d935f4d..5322c53c44 100644 --- a/docs/mitre-map/coverage.csv +++ b/docs/mitre-map/coverage.csv @@ -1,660 +1,179249 @@ Technique ID,Detection Available,Link,score -T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 -T1102,No,-,0 -T1059.002,No,-,0 -T1009,No,-,0 -T1027.005,No,-,0 -T1495,No,-,0 -T1568,No,-,0 -T1050,No,-,0 -T1567,No,-,0 -T1011.001,No,-,0 -T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,1 -T1003.005,No,-,0 -T1110.002,No,-,0 -T1130,No,-,0 -T1542.001,No,-,0 -T1124,No,-,0 -T1215,No,-,0 -T1164,No,-,0 -T1501,No,-,0 -T1556,No,-,0 -T1176,No,-,0 -T1020,No,-,0 -T1205,No,-,0 -T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 -T1011,No,-,0 -T1018,No,-,0 -T1552.003,No,-,0 -T1053.002,No,-,0 -T1206,No,-,0 -T1107,No,-,0 -T1070.002,No,-,0 -T1570,No,-,0 -T1550.004,No,-,0 -T1110.001,No,-,0 -T1218.010,No,-,0 -T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 -T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 -T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 -T1014,No,-,0 -T1074.002,No,-,0 -T1499.001,No,-,0 -T1558.001,No,-,0 -T1192,No,-,0 -T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 -T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 -T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 -T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 -T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 -T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 -T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 -T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 -T1118,No,-,0 -T1195,No,-,0 -T1042,No,-,0 -T1218.004,No,-,0 -T1498,No,-,0 -T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 -T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 -T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 -T1548.004,No,-,0 -T1574.010,No,-,0 -T1035,No,-,0 -T1061,No,-,0 -T1175,No,-,0 -T1547.008,No,-,0 -T1183,No,-,0 -T1110.004,No,-,0 -T1134.003,No,-,0 -T1037.002,No,-,0 -T1148,No,-,0 -T1064,No,-,0 -T1165,No,-,0 -T1559,No,-,0 -T1546,No,-,0 -T1574,No,-,0 -T1187,No,-,0 -T1046,No,-,0 -T1106,No,-,0 -T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 -T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1493,No,-,0 -T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 -T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 -T1218.002,No,-,0 -T1563.001,No,-,0 -T1565,No,-,0 -T1070.004,No,-,0 -T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 -T1537,No,-,0 -T1218.009,No,-,0 -T1480,No,-,0 -T1218.005,No,-,0 -T1219,No,-,0 -T1025,No,-,0 -T1032,No,-,0 -T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 -T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,1 -T1029,No,-,0 -T1087,No,-,0 -T1184,No,-,0 -T1189,No,-,0 -T1002,No,-,0 -T1113,No,-,0 -T1561.001,No,-,0 -T1562.002,No,-,0 -T1547.007,No,-,0 -T1127,No,-,0 -T1186,No,-,0 -T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,1 -T1216,No,-,0 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 -T1555.001,No,-,0 -T1063,No,-,0 -T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 -T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 -T1562.007,No,-,0 -T1069.003,No,-,0 -T1137,No,-,0 -T1114.003,No,-,0 -T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 -T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 -T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 -T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 -T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 -T1098.004,No,-,0 -T1487,No,-,0 -T1132.001,No,-,0 -T1177,No,-,0 -T1134,No,-,0 -T1017,No,-,0 -T1059.005,No,-,0 -T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 -T1131,No,-,0 -T1055.003,No,-,0 -T1195.003,No,-,0 -T1548,No,-,0 -T1027.004,No,-,0 -T1077,No,-,0 -T1217,No,-,0 -T1557.001,No,-,0 -T1547.003,No,-,0 -T1496,No,-,0 -T1578.004,No,-,0 -T1539,No,-,0 -T1059.006,No,-,0 -T1037.003,No,-,0 -T1564.005,No,-,0 -T1126,No,-,0 -T1074,No,-,0 -T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 -T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 -T1001,No,-,0 -T1559.002,No,-,0 -T1223,No,-,0 -T1573.002,No,-,0 -T1090.003,No,-,0 -T1552.005,No,-,0 -T1172,No,-,0 -T1542.003,No,-,0 -T1099,No,-,0 -T1073,No,-,0 -T1574.001,No,-,0 -T1504,No,-,0 -T1213,No,-,0 -T1133,No,-,0 -T1556.001,No,-,0 -T1216.001,No,-,0 -T1055.014,No,-,0 -T1008,No,-,0 -T1208,No,-,0 -T1499.003,No,-,0 -T1569.001,No,-,0 -T1499.004,No,-,0 -T1547.005,No,-,0 -T1076,No,-,0 -T1529,No,-,0 -T1210,No,-,0 -T1052.001,No,-,0 -T1111,No,-,0 -T1102.002,No,-,0 -T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 -T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 -T1559.001,No,-,0 -T1140,No,-,0 -T1055.001,No,-,0 -T1499.002,No,-,0 -T1547.011,No,-,0 -T1211,No,-,0 -T1120,No,-,0 -T1497.003,No,-,0 -T1062,No,-,0 -T1080,No,-,0 -T1137.002,No,-,0 -T1005,No,-,0 -T1069.001,No,-,0 -T1505.001,No,-,0 -T1205.001,No,-,0 -T1560.002,No,-,0 -T1097,No,-,0 -T1045,No,-,0 T1568.001,No,-,0 -T1123,No,-,0 -T1139,No,-,0 -T1166,No,-,0 -T1197,No,-,0 -T1137.001,No,-,0 -T1567.001,No,-,0 -T1104,No,-,0 -T1049,No,-,0 -T1196,No,-,0 -T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 -T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 -T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 -T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 -T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 -T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 -T1089,No,-,0 -T1514,No,-,0 -T1560.001,No,-,0 -T1115,No,-,0 -T1528,No,-,0 -T1056.004,No,-,0 -T1218.007,No,-,0 -T1546.010,No,-,0 -T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 -T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 -T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 -T1066,No,-,0 -T1531,No,-,0 -T1110.003,No,-,0 -T1218.001,No,-,0 -T1548.001,No,-,0 -T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 -T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 -T1574.007,No,-,0 -T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 -T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 -T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 -T1505.002,No,-,0 -T1213.001,No,-,0 -T1105,No,-,0 -T1546.005,No,-,0 -T1546.004,No,-,0 -T1055.009,No,-,0 -T1007,No,-,0 -T1564.001,No,-,0 -T1003.008,No,-,0 -T1491.002,No,-,0 -T1546.003,No,-,0 -T1146,No,-,0 -T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 -T1101,No,-,0 -T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 -T1574.002,No,-,0 -T1169,No,-,0 -T1546.012,No,-,0 -T1021.003,No,-,0 -T1209,No,-,0 -T1547.010,No,-,0 -T1167,No,-,0 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 -T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 -T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 -T1056.002,No,-,0 -T1564.006,No,-,0 -T1574.011,No,-,0 -T1573,No,-,0 -T1490,No,-,0 -T1037.005,No,-,0 -T1542.002,No,-,0 -T1188,No,-,0 -T1142,No,-,0 -T1039,No,-,0 -T1543.002,No,-,0 -T1553.002,No,-,0 -T1556.003,No,-,0 -T1547,No,-,0 -T1578,No,-,0 -T1578.001,No,-,0 -T1053.003,No,-,0 -T1561,No,-,0 -T1074.001,No,-,0 -T1151,No,-,0 -T1034,No,-,0 -T1134.005,No,-,0 -T1055.004,No,-,0 -T1543.001,No,-,0 -T1027.003,No,-,0 -T1550.003,No,-,0 -T1564.003,No,-,0 -T1013,No,-,0 -T1518.001,No,-,0 -T1505.003,No,-,0 -T1572,No,-,0 -T1534,No,-,0 -T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 -T1036.002,No,-,0 -T1483,No,-,0 -T1022,No,-,0 -T1574.004,No,-,0 -T1558,No,-,0 -T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 -T1546.009,No,-,0 -T1574.012,No,-,0 -T1218,No,-,0 -T1558.002,No,-,0 -T1036.003,No,-,0 -T1552.004,No,-,0 -T1560,No,-,0 -T1564.002,No,-,0 -T1562.003,No,-,0 -T1135,No,-,0 -T1212,No,-,0 -T1555.003,No,-,0 -T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 -T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,1 -T1546.015,No,-,0 -T1505,No,-,0 -T1059,No,-,0 -T1003.006,No,-,0 -T1114,No,-,0 -T1555.002,No,-,0 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1128,No,-,0 -T1060,No,-,0 -T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 -T1134.004,No,-,0 -T1553,No,-,0 -T1547.004,No,-,0 -T1056,No,-,0 -T1001.003,No,-,0 -T1083,No,-,0 -T1498.001,No,-,0 -T1553.003,No,-,0 -T1093,No,-,0 -T1198,No,-,0 -T1094,No,-,0 -T1218.008,No,-,0 -T1199,No,-,0 -T1090.004,No,-,0 -T1087.003,No,-,0 -T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 -T1055.012,No,-,0 -T1001.002,No,-,0 -T1182,No,-,0 -T1562.006,No,-,0 -T1040,No,-,0 -T1574.006,No,-,0 -T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 -T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 -T1043,No,-,0 -T1174,No,-,0 -T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,1 -T1090.001,No,-,0 -T1546.013,No,-,0 -T1003.007,No,-,0 -T1564.004,No,-,0 -T1168,No,-,0 -T1552,No,-,0 -T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 -T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 -T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 -T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 -T1059.007,No,-,0 -T1162,No,-,0 -T1546.006,No,-,0 -T1087.004,No,-,0 -T1117,No,-,0 -T1087.001,No,-,0 -T1218.003,No,-,0 -T1547.006,No,-,0 -T1055.005,No,-,0 -T1156,No,-,0 -T1001.001,No,-,0 -T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 -T1087.002,No,-,0 -T1491,No,-,0 -T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 -T1053.004,No,-,0 -T1143,No,-,0 -T1037.001,No,-,0 -T1055.011,No,-,0 -T1021,No,-,0 -T1222.002,No,-,0 -T1030,No,-,0 -T1054,No,-,0 -T1568.003,No,-,0 -T1053.001,No,-,0 -T1132,No,-,0 -T1070.006,No,-,0 -T1147,No,-,0 -T1085,No,-,0 -T1173,No,-,0 -T1024,No,-,0 -T1486,No,-,0 -T1181,No,-,0 -T1567.002,No,-,0 -T1573.001,No,-,0 -T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 -T1122,No,-,0 -T1522,No,-,0 -T1121,No,-,0 -T1134.002,No,-,0 -T1557,No,-,0 -T1191,No,-,0 -T1550,No,-,0 -T1546.007,No,-,0 -T1056.003,No,-,0 -T1548.002,No,-,0 -T1565.003,No,-,0 -T1037.004,No,-,0 -T1084,No,-,0 -T1048.002,No,-,0 -T1569,No,-,0 -T1500,No,-,0 -T1563.002,No,-,0 -T1553.001,No,-,0 -T1015,No,-,0 -T1137.005,No,-,0 -T1202,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 T1027.002,No,-,0 -T1144,No,-,0 -T1547.002,No,-,0 -T1149,No,-,0 -T1538,No,-,0 -T1220,No,-,0 -T1489,No,-,0 -T1550.001,No,-,0 -T1556.002,No,-,0 -T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 -T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 -T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 -T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 -T1010,No,-,0 -T1116,No,-,0 -T1574.005,No,-,0 -T1036.004,No,-,0 -T1543.004,No,-,0 -T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 -T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 -T1102.003,No,-,0 -T1482,No,-,0 -T1499,No,-,0 -T1578.002,No,-,0 -T1204.001,No,-,0 -T1194,No,-,0 -T1016,No,-,0 -T1071.003,No,-,0 -T1075,No,-,0 -T1051,No,-,0 -T1160,No,-,0 -T1497.002,No,-,0 -T1163,No,-,0 -T1023,No,-,0 -T1222,No,-,0 -T1561.002,No,-,0 -T1200,No,-,0 -T1055.008,No,-,0 -T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 -T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1518,No,-,0 -T1213.002,No,-,0 -T1031,No,-,0 -T1036.006,No,-,0 -T1152,No,-,0 -T1178,No,-,0 -T1098.001,No,-,0 -T1019,No,-,0 -T1154,No,-,0 -T1185,No,-,0 -T1527,No,-,0 -T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 -T1494,No,-,0 -T1056.001,No,-,0 -T1070.003,No,-,0 -T1096,No,-,0 -T1214,No,-,0 -T1492,No,-,0 -T1021.006,No,-,0 -T1108,No,-,0 -T1180,No,-,0 -T1484,No,-,0 -T1136.002,No,-,0 -T1488,No,-,0 -T1086,No,-,0 -T1055.013,No,-,0 -T1502,No,-,0 -T1044,No,-,0 -T1055,No,-,0 -T1552.001,No,-,0 -T1546.002,No,-,0 -T1157,No,-,0 -T1134.001,No,-,0 -T1574.008,No,-,0 -T1006,No,-,0 -T1090.002,No,-,0 -T1578.003,No,-,0 -T1555,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 T1201,No,-,0 -T1207,No,-,0 -T1021.005,No,-,0 -T1547.009,No,-,0 -T1138,No,-,0 -T1221,No,-,0 -T1125,No,-,0 -T1026,No,-,0 -T1161,No,-,0 -T1070.005,No,-,0 -T1069.002,No,-,0 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 -T1204,No,-,0 -T1195.001,No,-,0 -T1033,No,-,0 -T1110,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 T1037,No,-,0 -T1090,No,-,0 -T1565.002,No,-,0 -T1542,No,-,0 -T1562,No,-,0 -T1568.002,No,-,0 -T1565.001,No,-,0 -T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 -T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 T1052,No,-,0 -T1071,No,-,0 -T1564,No,-,0 -T1503,No,-,0 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 -T1519,No,-,0 -T1158,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 -T1038,No,-,0 -T1004,No,-,0 -T1067,No,-,0 -T1055.002,No,-,0 -T1109,No,-,0 -T1081,No,-,0 -T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 -T1506,No,-,0 -T1098.003,No,-,0 -T1098.002,No,-,0 -T1048.001,No,-,0 -T1137.003,No,-,0 -T1150,No,-,0 -T1057,No,-,0 -T1137.004,No,-,0 -T1103,No,-,0 -T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 -T1195.002,No,-,0 -T1179,No,-,0 -T1058,No,-,0 -T1091,No,-,0 -T1563,No,-,0 -T1021.004,No,-,0 -T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 -T1536,No,-,0 -T1069,No,-,0 -T1036.001,No,-,0 -T1092,No,-,0 -T1129,No,-,0 -T1132.002,No,-,0 -T1159,No,-,0 -T1497.001,No,-,0 -T1065,No,-,0 -T1552.002,No,-,0 -T1560.003,No,-,0 -T1003,No,-,0 -T1170,No,-,0 -T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 -T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 -T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 -T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 -T1136.003,No,-,0 -T1098,No,-,0 -T1491.001,No,-,0 -T1053,No,-,0 -T1027.001,No,-,0 -T1137.006,No,-,0 -T1127.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 -T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1543,No,-,0 -T1171,No,-,0 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 T1059.004,No,-,0 -T1155,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 -T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 -T1153,No,-,0 -T1145,No,-,0 -T1100,No,-,0 -T1079,No,-,0 -T1480.001,No,-,0 -T1552.006,No,-,0 -T1548.003,No,-,0 -T1041,No,-,0 -T1193,No,-,0 -T1036.005,No,-,0 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 T1554,No,-,0 -T1571,No,-,0 -T1102.001,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 T1141,No,-,0 -T1119,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 T1028,No,-,0 -T1497,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 +T1568.001,No,-,0 +T1218.010,No,-,0 +T1213,No,-,0 +T1519,No,-,0 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,2 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,2 +T1027.002,No,-,0 +T1020,No,-,0 +T1158,No,-,0 +T1164,No,-,0 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,4 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,4 +T1201,No,-,0 +T1578.003,No,-,0 +T1049,No,-,0 +T1547.011,No,-,0 +T1185,No,-,0 +T1564.005,No,-,0 +T1119,No,-,0 +T1037,No,-,0 +T1055.005,No,-,0 +T1199,No,-,0 +T1547.003,No,-,0 +T1069.003,No,-,0 +T1537,No,-,0 +T1192,No,-,0 +T1146,No,-,0 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,3 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,3 +T1069,No,-,0 +T1044,No,-,0 +T1505,No,-,0 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,2 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,2 +T1542.001,No,-,0 +T1514,No,-,0 +T1552,No,-,0 +T1052,No,-,0 +T1556.003,No,-,0 +T1563.001,No,-,0 +T1499.002,No,-,0 +T1574,No,-,1 +T1563,No,-,0 +T1055.014,No,-,0 +T1134.005,No,-,0 +T1558,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2 +T1542.002,No,-,0 +T1077,No,-,0 +T1121,No,-,0 +T1059.006,No,-,0 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,2 +T1574.002,No,-,0 +T1079,No,-,0 +T1213.001,No,-,0 +T1504,No,-,0 +T1090.001,No,-,0 +T1083,No,-,0 +T1552.001,No,-,0 +T1134,No,-,0 +T1144,No,-,0 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml,3 +T1530,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,3 +T1120,No,-,0 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,2 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 +T1550,No,-,1 +T1547.004,No,-,0 +T1218.003,No,-,0 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,2 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2 +T1059.004,No,-,0 +T1011.001,No,-,0 +T1100,No,-,0 +T1054,No,-,0 +T1021,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,7 +T1564,No,-,0 +T1547.009,No,-,0 +T1022,No,-,0 +T1102.001,No,-,0 +T1105,No,-,0 +T1559.001,No,-,0 +T1036.001,No,-,0 +T1070.004,No,-,0 +T1578.004,No,-,0 +T1572,No,-,0 +T1546.009,No,-,0 +T1518,No,-,0 +T1501,No,-,0 +T1053.002,No,-,0 +T1548.002,No,-,0 +T1212,No,-,0 +T1065,No,-,0 +T1546.003,No,-,0 +T1175,No,-,0 +T1552.004,No,-,0 +T1223,No,-,0 +T1574.008,No,-,0 +T1015,No,-,0 +T1567.002,No,-,0 +T1218.002,No,-,0 +T1023,No,-,0 +T1183,No,-,0 +T1125,No,-,0 +T1200,No,-,0 +T1108,No,-,0 +T1578.001,No,-,0 +T1136,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1573.002,No,-,0 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,7 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 +T1147,No,-,0 +T1004,No,-,0 +T1205,No,-,0 +T1552.006,No,-,0 +T1104,No,-,0 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,2 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,2 +T1056,No,-,0 +T1219,No,-,0 +T1567.001,No,-,0 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,1 +T1036.002,No,-,0 +T1046,No,-,0 +T1115,No,-,0 +T1554,No,-,0 +T1546.002,No,-,0 +T1565.001,No,-,0 +T1502,No,-,0 +T1211,No,-,0 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,1 +T1080,No,-,0 +T1560.003,No,-,0 +T1180,No,-,0 +T1070.005,No,-,0 +T1542.003,No,-,0 +T1555.001,No,-,0 +T1052.001,No,-,0 +T1056.004,No,-,0 +T1094,No,-,0 +T1001.003,No,-,0 +T1076,No,-,0 +T1215,No,-,0 +T1218.007,No,-,0 +T1178,No,-,0 +T1171,No,-,0 +T1140,No,-,0 +T1025,No,-,0 +T1136.003,No,-,0 +T1547.007,No,-,0 +T1552.003,No,-,0 +T1213.002,No,-,0 +T1001.001,No,-,0 +T1195.002,No,-,0 +T1053,No,-,4 +T1209,No,-,0 +T1069.001,No,-,0 +T1193,No,-,0 +T1179,No,-,0 +T1098.003,No,-,0 +T1505.002,No,-,0 +T1059.002,No,-,0 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml,4 +T1078.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,1 +T1563.002,No,-,0 +T1558.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,1 +T1099,No,-,0 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,8 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,8 +T1195.001,No,-,0 +T1497.001,No,-,0 +T1536,No,-,0 +T1058,No,-,0 +T1005,No,-,0 +T1148,No,-,0 +T1038,No,-,0 +T1552.002,No,-,0 +T1218.005,No,-,0 +T1486,No,-,0 +T1003.008,No,-,0 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,21 +T1053.001,No,-,0 +T1557.001,No,-,0 +T1500,No,-,0 +T1170,No,-,0 +T1166,No,-,0 +T1051,No,-,0 +T1498.001,No,-,0 +T1210,No,-,0 +T1074.002,No,-,0 +T1202,No,-,0 +T1495,No,-,0 +T1561.002,No,-,0 +T1102.003,No,-,0 +T1574.009,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml,1 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,2 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,2 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1087.001,No,-,0 +T1218.008,No,-,0 +T1547.005,No,-,0 +T1040,No,-,0 +T1153,No,-,0 +T1087.003,No,-,0 +T1071,No,-,10 +T1129,No,-,0 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,1 +T1155,No,-,0 +T1085,No,-,0 +T1177,No,-,0 +T1021.004,No,-,0 +T1042,No,-,0 +T1090.003,No,-,0 +T1134.004,No,-,0 +T1053.004,No,-,0 +T1221,No,-,0 +T1557,No,-,0 +T1003.007,No,-,0 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,2 +T1555.003,No,-,0 +T1132.002,No,-,0 +T1113,No,-,0 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,2 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,1 +T1208,No,-,0 +T1499,No,-,0 +T1561,No,-,0 +T1497.003,No,-,0 +T1009,No,-,0 +T1496,No,-,0 +T1216.001,No,-,0 +T1011,No,-,0 +T1548.004,No,-,0 +T1127,No,-,0 +T1562.006,No,-,0 +T1124,No,-,0 +T1126,No,-,0 +T1055.004,No,-,0 +T1098.002,No,-,0 +T1505.003,No,-,0 +T1031,No,-,0 +T1574.007,No,-,0 +T1137.002,No,-,0 +T1491.002,No,-,0 +T1548.003,No,-,0 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,7 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,7 +T1021.003,No,-,0 +T1048.002,No,-,0 +T1196,No,-,0 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 +T1169,No,-,0 +T1128,No,-,0 +T1548.001,No,-,0 +T1172,No,-,0 +T1149,No,-,0 +T1543,No,-,1 +T1498.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml,1 +T1182,No,-,0 +T1547,No,-,3 +T1059,No,-,15 +T1093,No,-,0 +T1553.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 +T1037.002,No,-,0 +T1098,No,-,0 +T1527,No,-,0 +T1220,No,-,0 +T1034,No,-,0 +T1141,No,-,0 +T1116,No,-,0 +T1003.005,No,-,0 +T1041,No,-,0 +T1055.002,No,-,0 +T1522,No,-,0 +T1074.001,No,-,0 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1111,No,-,0 +T1546.005,No,-,0 +T1050,No,-,0 +T1574.001,No,-,0 +T1055.011,No,-,0 +T1184,No,-,0 +T1074,No,-,0 +T1542,No,-,0 +T1073,No,-,0 +T1092,No,-,0 +T1014,No,-,0 +T1189,No,-,0 +T1137.006,No,-,0 +T1075,No,-,0 +T1087.002,No,-,0 +T1134.003,No,-,0 +T1222.002,No,-,0 +T1562.002,No,-,0 +T1548,No,-,0 +T1035,No,-,0 +T1555,No,-,0 +T1561.001,No,-,0 +T1098.004,No,-,0 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,4 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,4 +T1017,No,-,0 +T1205.001,No,-,0 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,1 +T1565.002,No,-,0 +T1569,No,-,1 +T1499.004,No,-,0 +T1037.005,No,-,0 +T1553.003,No,-,0 +T1546.004,No,-,0 +T1053.003,No,-,0 +T1560,No,-,0 +T1181,No,-,0 +T1565,No,-,0 +T1131,No,-,0 +T1558.002,No,-,0 +T1218.009,No,-,0 +T1001.002,No,-,0 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,1 +T1160,No,-,0 +T1060,No,-,0 +T1560.001,No,-,0 +T1489,No,-,0 +T1207,No,-,0 +T1204,No,-,1 +T1553.001,No,-,0 +T1018,No,-,0 +T1547.002,No,-,0 +T1091,No,-,0 +T1019,No,-,0 +T1543.001,No,-,0 +T1555.002,No,-,0 +T1492,No,-,0 +T1048,Yes,https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml,3 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1525,Yes,https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 +T1574.004,No,-,0 +T1550.003,No,-,0 +T1480,No,-,0 +T1161,No,-,0 +T1558.001,No,-,0 +T1214,No,-,0 +T1546.006,No,-,0 +T1556,No,-,0 +T1087,No,-,0 +T1574.005,No,-,0 +T1506,No,-,0 +T1564.001,No,-,0 +T1130,No,-,0 +T1139,No,-,0 +T1045,No,-,0 +T1546.007,No,-,0 +T1032,No,-,0 +T1090,No,-,0 +T1498,No,-,1 +T1027.005,No,-,0 +T1543.004,No,-,0 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 +T1097,No,-,0 +T1546,No,-,5 +T1556.002,No,-,0 +T1176,No,-,0 +T1562,No,-,3 +T1187,No,-,0 +T1070.006,No,-,0 +T1186,No,-,0 +T1057,No,-,0 +T1543.002,No,-,0 +T1574.010,No,-,0 +T1028,No,-,0 +T1010,No,-,0 +T1565.003,No,-,0 +T1056.001,No,-,0 +T1110.003,No,-,0 +T1109,No,-,0 +T1142,No,-,0 +T1154,No,-,0 +T1547.006,No,-,0 +T1487,No,-,0 +T1037.003,No,-,0 +T1071.003,No,-,0 +T1027.003,No,-,0 +T1055.012,No,-,0 +T1056.003,No,-,0 +T1090.004,No,-,0 +T1137,No,-,0 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,1 +T1110.001,No,-,0 +T1204.001,No,-,0 +T1222.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 +T1137.001,No,-,0 +T1027.004,No,-,0 +T1106,No,-,0 +T1036.005,No,-,0 +T1553.002,No,-,0 +T1070.003,No,-,0 +T1218.001,No,-,0 +T1482,No,-,0 +T1137.005,No,-,0 +T1013,No,-,0 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 +T1123,No,-,0 +T1021.005,No,-,0 +T1574.006,No,-,0 +T1012,No,-,0 +T1499.003,No,-,0 +T1218.004,No,-,0 +T1168,No,-,0 +T1048.001,No,-,0 +T1222,No,-,1 +T1173,No,-,0 +T1156,No,-,0 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 +T1134.002,No,-,0 +T1055.003,No,-,0 +T1480.001,No,-,0 +T1570,No,-,0 +T1101,No,-,0 +T1029,No,-,0 +T1534,No,-,0 +T1556.001,No,-,0 +T1086,No,-,0 +T1494,No,-,0 +T1491.001,No,-,0 +T1056.002,No,-,0 +T1008,No,-,0 +T1036.004,No,-,0 +T1195.003,No,-,0 +T1055,No,-,0 +T1568.003,No,-,0 +T1007,No,-,0 +T1574.011,No,-,0 +T1067,No,-,0 +T1505.001,No,-,0 +T1206,No,-,0 +T1062,No,-,0 +T1152,No,-,0 +T1564.003,No,-,0 +T1114.003,No,-,0 +T1528,No,-,0 +T1037.001,No,-,0 +T1198,No,-,0 +T1064,No,-,0 +T1145,No,-,0 +T1059.005,No,-,0 +T1493,No,-,0 +T1110.004,No,-,0 +T1055.008,No,-,0 +T1568,No,-,0 +T1081,No,-,0 +T1055.001,No,-,0 +T1194,No,-,0 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1546.010,No,-,0 +T1002,No,-,0 +T1039,No,-,0 +T1573.001,No,-,0 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,4 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,4 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 +T1550.001,No,-,0 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 +T1538,No,-,0 +T1191,No,-,0 +T1001,No,-,0 +T1150,No,-,0 +T1098.001,No,-,0 +T1568.002,No,-,0 +T1547.008,No,-,0 +T1133,No,-,0 +T1559.002,No,-,0 +T1567,No,-,0 +T1084,No,-,0 +T1114,No,-,3 +T1070.002,No,-,0 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml,8 +T1535,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml,8 +T1564.002,No,-,0 +T1484,No,-,0 +T1055.009,No,-,0 +T1135,No,-,0 +T1574.012,No,-,0 +T1564.004,No,-,0 +T1163,No,-,0 +T1562.007,No,-,0 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 +T1090.002,No,-,0 +T1564.006,No,-,0 +T1066,No,-,0 +T1055.013,No,-,0 +T1491,No,-,0 +T1546.012,No,-,0 +T1197,No,-,0 +T1547.010,No,-,0 +T1016,No,-,0 +T1499.001,No,-,0 +T1573,No,-,0 +T1127.001,No,-,0 +T1117,No,-,0 +T1027.001,No,-,0 +T1546.014,No,-,0 +T1162,No,-,0 +T1559,No,-,0 +T1503,No,-,0 +T1195,No,-,0 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,6 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6 +T1122,No,-,0 +T1560.002,No,-,0 +T1110.002,No,-,0 +T1566,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml,5 +T1059.007,No,-,0 +T1043,No,-,0 +T1488,No,-,0 +T1529,No,-,0 +T1096,No,-,0 +T1550.004,No,-,0 +T1217,No,-,0 +T1218,No,-,1 +T1578,No,-,0 +T1546.015,No,-,0 +T1006,No,-,0 +T1137.003,No,-,0 +T1174,No,-,0 +T1134.001,No,-,0 +T1070,Yes,https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml,3 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,1 +T1030,No,-,0 +T1137.004,No,-,0 +T1036.006,No,-,0 +T1539,No,-,0 +T1518.001,No,-,0 +T1061,No,-,0 +T1151,No,-,0 +T1578.002,No,-,0 +T1037.004,No,-,0 +T1107,No,-,0 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1103,No,-,0 +T1490,No,-,0 +T1483,No,-,0 +T1088,No,-,0 +T1159,No,-,0 +T1165,No,-,0 +T1132.001,No,-,0 +T1003.004,No,-,0 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,2 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,2 +T1102,No,-,0 +T1024,No,-,0 +T1157,No,-,0 +T1003,No,-,12 +T1087.004,No,-,0 +T1552.005,No,-,0 +T1562.003,No,-,0 +T1553,No,-,1 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,3 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,3 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,5 +T1526,Yes,https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml,5 +T1216,No,-,0 +T1063,No,-,0 +T1036.003,No,-,0 +T1569.001,No,-,0 +T1118,No,-,0 +T1571,No,-,0 +T1069.002,No,-,0 +T1089,No,-,0 +T1143,No,-,0 +T1003.006,No,-,0 +T1497.002,No,-,0 +T1188,No,-,0 +T1110,No,-,0 +T1531,No,-,0 +T1138,No,-,0 +T1132,No,-,0 +T1546.013,No,-,0 +T1026,No,-,0 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,5 +T1102.002,No,-,0 +T1033,No,-,0 +T1021.006,No,-,0 +T1497,No,-,0 +T1167,No,-,0 +T1136.002,No,-,0 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,13 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,13 diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json index a07e978f46..b52e18ea73 100644 --- a/docs/mitre-map/coverage.json +++ b/docs/mitre-map/coverage.json @@ -4,24 +4,23 @@ "description": "security-content detection coverage", "domain": "mitre-enterprise", "techniques": [ + {}, + {}, + {}, + {}, { - "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" }, {}, {}, {}, {}, - {}, - {}, - {}, - {}, - {}, { - "techniqueID": "T1078", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" }, {}, {}, @@ -35,27 +34,17 @@ {}, {}, {}, - { - "techniqueID": "T1204.002", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" - }, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, {}, {}, {}, { - "techniqueID": "T1485", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" }, + {}, + {}, + {}, { "techniqueID": "T1114.002", "score": 2, @@ -66,76 +55,72 @@ {}, {}, {}, + {}, + {}, + {}, + {}, + {}, + {}, { - "techniqueID": "T1535", - "score": 8, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml" + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" }, {}, {}, {}, {}, {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, { "techniqueID": "T1546.011", "score": 3, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" }, {}, {}, {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, { - "techniqueID": "T1071.001", + "techniqueID": "T1068", "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" - }, - {}, - { - "techniqueID": "T1021.002", - "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" }, {}, {}, {}, {}, { - "techniqueID": "T1027", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" - }, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - { - "techniqueID": "T1546.001", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" - }, - { - "techniqueID": "T1566", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" }, {}, {}, @@ -148,41 +133,59 @@ {}, {}, {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, { - "techniqueID": "T1070", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, { "techniqueID": "T1059.003", "score": 7, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" }, {}, {}, + {}, + {}, + {}, { - "techniqueID": "T1569.002", + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" - }, - { - "techniqueID": "T1566.003", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" }, {}, {}, {}, {}, - { - "techniqueID": "T1526", - "score": 5, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" - }, - {}, - {}, - {}, {}, {}, {}, @@ -209,123 +212,30 @@ {}, {}, {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, { - "techniqueID": "T1048.003", - "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml" + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" }, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, { - "techniqueID": "T1068", - "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml" - }, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - { - "techniqueID": "T1047", - "score": 6, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml" - }, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - { - "techniqueID": "T1136.001", - "score": 3, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml" - }, - {}, - {}, - {}, - {}, - {}, - { - "techniqueID": "T1095", + "techniqueID": "T1562.004", "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" }, - { - "techniqueID": "T1550.002", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" - }, - {}, - { - "techniqueID": "T1530", - "score": 3, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" - }, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, {}, { "techniqueID": "T1558.003", @@ -334,9 +244,9 @@ }, {}, { - "techniqueID": "T1553.004", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" }, {}, {}, @@ -345,15 +255,118 @@ {}, {}, {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, { "techniqueID": "T1071.004", "score": 7, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" }, + {}, + {}, + {}, { - "techniqueID": "T1203", + "techniqueID": "T1071.001", "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -361,46 +374,19 @@ {}, {}, {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, { - "techniqueID": "T1114.001", + "techniqueID": "T1498.002", "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" }, {}, {}, {}, {}, - {}, { - "techniqueID": "T1222.001", + "techniqueID": "T1553.004", "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" }, {}, {}, @@ -419,10 +405,40 @@ "score": 1, "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, { - "techniqueID": "T1136", + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" }, {}, {}, @@ -430,17 +446,18 @@ {}, {}, {}, - { - "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml" - }, + {}, + {}, + {}, + {}, + {}, + {}, {}, {}, { - "techniqueID": "T1574.009", + "techniqueID": "T1078.002", "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" }, {}, {}, @@ -456,69 +473,113 @@ {}, {}, {}, - {}, - { - "techniqueID": "T1546.008", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" - }, - {}, - {}, - {}, - {}, - {}, - {}, - { - "techniqueID": "T1190", - "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" - }, - {}, - {}, { "techniqueID": "T1048", - "score": 1, + "score": 3, "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" }, - {}, - {}, - {}, - {}, - {}, - {}, { - "techniqueID": "T1547.001", - "score": 3, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml" - }, - { - "techniqueID": "T1566.002", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" - }, - { - "techniqueID": "T1078.004", - "score": 13, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml" - }, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - { - "techniqueID": "T1070.001", + "techniqueID": "T1525", "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" }, {}, {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -544,6 +605,76 @@ {}, {}, {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, { "techniqueID": "T1003.002", "score": 1, @@ -568,6 +699,536 @@ {}, {}, {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, {}, {}, {}, @@ -582,17 +1243,14 @@ { "techniqueID": "T1021.001", "score": 4, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" }, {}, {}, - {}, - {}, - {}, { - "techniqueID": "T1003.003", - "score": 4, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml" + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" }, {}, {}, @@ -608,26 +1266,6 @@ {}, {}, {}, - {}, - {}, - {}, - {}, - { - "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" - }, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, - {}, { "techniqueID": "T1078.002", "score": 1, @@ -647,6 +1285,52 @@ {}, {}, {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, {}, {}, {}, @@ -671,9 +1355,16 @@ {}, {}, { - "techniqueID": "T1059.001", - "score": 8, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml" + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" }, {}, {}, @@ -685,27 +1376,246 @@ {}, {}, {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, {}, { "techniqueID": "T1566.001", "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" }, {}, {}, {}, {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, { "techniqueID": "T1036", "score": 5, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - {}, - {}, - { - "techniqueID": "T1112", - "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" }, {}, {}, @@ -714,9 +1624,80 @@ {}, {}, { - "techniqueID": "T1525", + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" }, {}, {}, @@ -730,7 +1711,286 @@ { "techniqueID": "T1078.003", "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -747,6 +2007,14 @@ {}, {}, {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, {}, {}, {}, @@ -756,11 +2024,637 @@ {}, {}, {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, { "techniqueID": "T1053.005", "score": 4, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, {}, {}, {}, @@ -771,8 +2665,754 @@ { "techniqueID": "T1078.001", "score": 4, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, {}, {}, {}, @@ -782,10 +3422,26 @@ "score": 2, "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" }, + {}, + {}, + {}, { - "techniqueID": "T1562.004", + "techniqueID": "T1566.002", "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" }, {}, {}, @@ -807,15 +3463,217420 @@ {}, {}, {}, - {} + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.003", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1114.002", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1558", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.003", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1530", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml" + }, + {}, + { + "techniqueID": "T1112", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1546.011", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1068", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1136", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___account_harvesting.yml" + }, + {}, + { + "techniqueID": "T1059.003", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1562.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1072", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" + }, + { + "techniqueID": "T1562.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + {}, + { + "techniqueID": "T1558.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml" + }, + {}, + { + "techniqueID": "T1059.001", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078", + "score": 21, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1574.009", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_path_interception_by_creation_of_program_exe.yml" + }, + { + "techniqueID": "T1190", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1095", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1204.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1082", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1546.008", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.004", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1071.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1498.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/large_volume_of_dns_any_queries.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1553.004", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1071.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1021.001", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + {}, + {}, + { + "techniqueID": "T1569.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1048", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/prohibited_network_traffic_allowed.yml" + }, + { + "techniqueID": "T1525", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1027", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1566.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1485", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + {}, + {}, + { + "techniqueID": "T1222.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1203", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1543.003", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1218.011", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1053.005", + "score": 4, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1546.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + {}, + { + "techniqueID": "T1003.001", + "score": 7, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1535", + "score": 8, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_in_previously_unseen_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_city.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_started_in_previously_unused_region.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_console_login_by_user_from_new_region.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1003.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1047", + "score": 6, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + {}, + {}, + {}, + { + "techniqueID": "T1566", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1070", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/usn_journal_deletion.yml" + }, + { + "techniqueID": "T1550.002", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1114.001", + "score": 1, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1566.001", + "score": 2, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1547.001", + "score": 3, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1526", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_pod_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/amazon_eks_kubernetes_pod_scan_detection.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1036", + "score": 5, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + {}, + {}, + {}, + {}, + {}, + {}, + { + "techniqueID": "T1078.004", + "score": 13, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + } ], "gradient": { "colors": [ - "##ffffff", - "#8ec843" + "#ffffff", + "#66b1ff", + "#096ed7" ], "minValue": 0, - "maxValue": 0 + "maxValue": 13 }, "filters": { "platforms": [ @@ -835,8 +220896,8 @@ "color": "#ffffff" }, { - "label": "Available detections", - "color": "#8ec843" + "label": "Some detections available", + "color": "#66b1ff" } ], "showTacticRowBackground": true, diff --git a/docs/mitre-map/coverage.png b/docs/mitre-map/coverage.png index 8a3077b0ea..a2fb672bff 100644 Binary files a/docs/mitre-map/coverage.png and b/docs/mitre-map/coverage.png differ diff --git a/docs/mitre-map/detections.csv b/docs/mitre-map/detections.csv index 4701026bf5..a1fe43a7f6 100644 --- a/docs/mitre-map/detections.csv +++ b/docs/mitre-map/detections.csv @@ -1,390 +1,105809 @@ Technique ID,Detection Available,Link,score -T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 -T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 +T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,52 T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1193,No,-,51 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml,49 +T1566.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 +T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 T1204.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml,49 -T1027,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,47 -T1086,No,-,44 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 -T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,36 +T1059.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,36 +T1086,No,-,44 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 -T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,34 +T1059.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,34 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 +T1105,No,-,40 T1105,No,-,40 T1060,No,-,38 -T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 +T1060,No,-,38 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,35 +T1547.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml,35 T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml,32 +T1071.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,32 +T1070.004,No,-,30 T1107,No,-,30 T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1070.004,No,-,30 +T1107,No,-,30 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 -T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,27 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,24 +T1053.005,Yes,https://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml,24 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 +T1003.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 +T1059.005,No,-,26 T1059.005,No,-,26 T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 -T1078,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml,23 +T1082,Yes,https://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 +T1192,No,-,24 +T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 T1192,No,-,24 T1566.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml,23 -T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 -T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 +T1083,No,-,23 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,21 +T1203,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,21 T1005,No,-,22 -T1016,No,-,22 T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1005,No,-,22 +T1057,No,-,22 +T1016,No,-,22 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 +T1055,No,-,21 T1076,No,-,20 -T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 -T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 +T1056.001,No,-,20 +T1076,No,-,20 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml,16 +T1021.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml,16 T1056.001,No,-,20 -T1018,No,-,19 T1140,No,-,19 +T1018,No,-,19 T1204.001,No,-,19 T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1140,No,-,19 +T1018,No,-,19 +T1204.001,No,-,19 +T1036.005,No,-,19 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 +T1033,No,-,18 +T1059,No,-,18 T1033,No,-,18 T1189,No,-,17 -T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 -T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 -T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 +T1189,No,-,17 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml,11 +T1047,Yes,https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,11 +T1003,No,-,17 T1560.001,No,-,16 -T1043,No,-,16 T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1560.001,No,-,16 +T1543.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,15 +T1043,No,-,16 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 T1555.003,No,-,15 T1503,No,-,15 T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml,13 +T1112,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml,13 +T1555.003,No,-,15 +T1503,No,-,15 T1049,No,-,14 -T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 -T1553.002,No,-,14 -T1074.001,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 T1087.001,No,-,14 T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 +T1049,No,-,14 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,11 +T1136.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml,11 +T1087.001,No,-,14 +T1116,No,-,14 +T1074.001,No,-,14 +T1553.002,No,-,14 T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1046,No,-,13 +T1027.002,No,-,12 T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 T1045,No,-,12 T1027.002,No,-,12 +T1113,No,-,12 T1041,No,-,12 -T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 -T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 +T1027.002,No,-,12 +T1113,No,-,12 +T1041,No,-,12 +T1560,No,-,12 +T1045,No,-,12 T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 -T1063,No,-,11 -T1073,No,-,11 -T1133,No,-,11 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 T1574.002,No,-,11 -T1518.001,No,-,11 -T1059,No,-,11 T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml,9 +T1021.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml,9 +T1574.002,No,-,11 +T1085,No,-,11 +T1073,No,-,11 +T1218.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,10 +T1133,No,-,11 +T1518.001,No,-,11 +T1063,No,-,11 +T1571,No,-,11 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 +T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,6 +T1100,No,-,10 T1505.003,No,-,10 T1087.002,No,-,10 +T1555,No,-,10 T1136.002,No,-,10 -T1055,No,-,10 T1100,No,-,10 -T1559.002,No,-,9 -T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1100,No,-,10 +T1505.003,No,-,10 +T1087.002,No,-,10 +T1555,No,-,10 +T1136.002,No,-,10 +T1119,No,-,9 T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 -T1564.003,No,-,9 -T1560,No,-,9 -T1143,No,-,9 -T1173,No,-,9 -T1090.002,No,-,9 -T1003,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 +T1119,No,-,9 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml,7 +T1068,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml,7 +T1562.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml,7 +T1090,No,-,9 +T1173,No,-,9 +T1564.003,No,-,9 +T1559.002,No,-,9 +T1090.002,No,-,9 +T1143,No,-,9 +T1110,No,-,9 T1218.010,No,-,8 -T1035,No,-,8 -T1219,No,-,8 -T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 -T1132.001,No,-,8 -T1102.002,No,-,8 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 -T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 -T1135,No,-,8 -T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 -T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 -T1117,No,-,8 T1548.002,No,-,8 T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1218.010,No,-,8 +T1548.002,No,-,8 +T1065,No,-,8 +T1219,No,-,8 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml,6 +T1190,Yes,https://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml,6 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml,1 +T1071.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml,1 +T1035,No,-,8 +T1569.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml,7 +T1137,No,-,8 +T1135,No,-,8 +T1117,No,-,8 +T1132.001,No,-,8 +T1003.004,No,-,8 +T1102.002,No,-,8 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 T1027.005,No,-,7 T1106,No,-,7 -T1066,No,-,7 -T1007,No,-,7 -T1059.007,No,-,7 -T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 -T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 -T1573.001,No,-,7 -T1023,No,-,7 -T1552.001,No,-,7 -T1555,No,-,7 -T1547.009,No,-,7 -T1221,No,-,7 -T1069.002,No,-,7 -T1021.004,No,-,7 T1012,No,-,7 -T1009,No,-,6 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1552.001,No,-,7 +T1547.009,No,-,7 +T1023,No,-,7 +T1071,No,-,7 +T1021.004,No,-,7 +T1221,No,-,7 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml,5 +T1070.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml,5 +T1098,No,-,7 +T1027.005,No,-,7 +T1106,No,-,7 +T1012,No,-,7 +T1007,No,-,7 +T1573.001,No,-,7 +T1066,No,-,7 +T1059.007,No,-,7 +T1102,No,-,7 +T1069.002,No,-,7 +T1037,No,-,6 T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 -T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 -T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 +T1027.001,No,-,6 +T1037,No,-,6 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml,4 +T1114.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 +T1048.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml,4 +T1134,No,-,6 +T1009,No,-,6 +T1036.004,No,-,6 +T1003.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5 T1027.001,No,-,6 -T1074.002,No,-,5 -T1218.005,No,-,5 -T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 -T1059.006,No,-,5 -T1223,No,-,5 -T1573.002,No,-,5 -T1099,No,-,5 -T1055.001,No,-,5 -T1120,No,-,5 -T1218.001,No,-,5 -T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 -T1564.001,No,-,5 -T1546.003,No,-,5 -T1027.003,No,-,5 -T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 -T1001.002,No,-,5 -T1040,No,-,5 -T1070.006,No,-,5 -T1084,No,-,5 -T1015,No,-,5 -T1194,No,-,5 -T1075,No,-,5 -T1110,No,-,5 -T1090,No,-,5 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,0 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,0 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,0 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,0 -T1036,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,0 T1158,No,-,5 -T1170,No,-,5 -T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 T1102.001,No,-,5 -T1102,No,-,4 -T1003.005,No,-,4 -T1124,No,-,4 -T1570,No,-,4 -T1014,No,-,4 -T1025,No,-,4 -T1487,No,-,4 -T1496,No,-,4 -T1574.001,No,-,4 -T1036.002,No,-,4 -T1036.003,No,-,4 -T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 -T1093,No,-,4 -T1094,No,-,4 -T1055.012,No,-,4 -T1561.002,No,-,4 -T1038,No,-,4 -T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 +T1158,No,-,5 +T1069,No,-,5 +T1059.006,No,-,5 +T1120,No,-,5 +T1102.001,No,-,5 +T1546.003,No,-,5 +T1223,No,-,5 +T1015,No,-,5 +T1573.002,No,-,5 +T1562.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml,4 +T1099,No,-,5 +T1218.005,No,-,5 +T1170,No,-,5 +T1074.002,No,-,5 +T1040,No,-,5 +T1546.008,Yes,https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml,4 +T1075,No,-,5 +T1001.002,No,-,5 +T1564.001,No,-,5 +T1566.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,4 +T1070.006,No,-,5 +T1027.003,No,-,5 +T1218.001,No,-,5 +T1055.001,No,-,5 +T1194,No,-,5 +T1084,No,-,5 +T1550.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,4 T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 T1560.003,No,-,4 -T1110.002,No,-,3 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,2 +T1078.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 +T1518,No,-,4 +T1036.002,No,-,4 +T1560.003,No,-,4 +T1094,No,-,4 +T1025,No,-,4 +T1038,No,-,4 +T1561.002,No,-,4 +T1496,No,-,4 +T1124,No,-,4 +T1093,No,-,4 +T1003.005,No,-,4 +T1071.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1574.001,No,-,4 +T1014,No,-,4 +T1487,No,-,4 +T1055.012,No,-,4 +T1570,No,-,4 +T1001,No,-,4 +T1195,No,-,4 +T1036.003,No,-,4 +T1213,No,-,3 T1020,No,-,3 -T1053.002,No,-,3 -T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 -T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 -T1027.004,No,-,3 -T1090.003,No,-,3 -T1542.003,No,-,3 -T1008,No,-,3 -T1529,No,-,3 -T1069.001,No,-,3 -T1097,No,-,3 -T1197,No,-,3 -T1104,No,-,3 -T1110.003,No,-,3 -T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 -T1188,No,-,3 -T1039,No,-,3 -T1550.003,No,-,3 T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 T1486,No,-,3 T1500,No,-,3 -T1071.003,No,-,3 -T1518,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 -T1071,No,-,3 -T1067,No,-,3 T1091,No,-,3 -T1098,No,-,3 -T1176,No,-,2 -T1187,No,-,2 -T1032,No,-,2 -T1137,No,-,2 -T1564.005,No,-,2 -T1210,No,-,2 -T1559.001,No,-,2 -T1080,No,-,2 -T1560.002,No,-,2 -T1115,No,-,2 -T1218.007,No,-,2 -T1542.002,No,-,2 -T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 -T1547.004,No,-,2 -T1199,No,-,2 -T1087.003,No,-,2 -T1090.001,No,-,2 -T1218.003,No,-,2 -T1037.001,No,-,2 -T1222.002,No,-,2 -T1567.002,No,-,2 -T1134.002,No,-,2 -T1191,No,-,2 -T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 -T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 +T1213,No,-,3 +T1020,No,-,3 +T1572,No,-,3 +T1053.002,No,-,3 +T1104,No,-,3 +T1072,Yes,https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml,2 +T1542.003,No,-,3 +T1069.001,No,-,3 +T1486,No,-,3 +T1500,No,-,3 +T1095,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,2 +T1090.003,No,-,3 +T1074,No,-,3 +T1078.002,Yes,https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml,2 +T1091,No,-,3 +T1550.003,No,-,3 +T1097,No,-,3 +T1110.003,No,-,3 +T1071.003,No,-,3 +T1485,Yes,https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml,2 +T1027.004,No,-,3 +T1008,No,-,3 +T1067,No,-,3 +T1039,No,-,3 +T1197,No,-,3 +T1573,No,-,3 +T1110.002,No,-,3 +T1529,No,-,3 +T1188,No,-,3 T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 -T1213.002,No,-,2 -T1492,No,-,2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 T1201,No,-,2 -T1125,No,-,2 -T1565.001,No,-,2 -T1004,No,-,2 -T1055.002,No,-,2 -T1109,No,-,2 -T1195.002,No,-,2 -T1069,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 T1480.001,No,-,2 -T1501,No,-,1 -T1070.002,No,-,1 -T1558.001,No,-,1 -T1195,No,-,1 -T1042,No,-,1 -T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 -T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 -T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 -T1183,No,-,1 -T1493,No,-,1 -T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 -T1561.001,No,-,1 -T1562.002,No,-,1 -T1186,No,-,1 -T1134,No,-,1 -T1126,No,-,1 -T1074,No,-,1 -T1001,No,-,1 -T1172,No,-,1 -T1504,No,-,1 -T1213,No,-,1 -T1216.001,No,-,1 -T1052.001,No,-,1 -T1211,No,-,1 -T1137.002,No,-,1 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1201,No,-,2 +T1564.005,No,-,2 +T1199,No,-,2 +T1542.002,No,-,2 +T1090.001,No,-,2 +T1547.004,No,-,2 +T1218.003,No,-,2 +T1059.004,No,-,2 +T1559.001,No,-,2 +T1567.002,No,-,2 +T1125,No,-,2 +T1004,No,-,2 +T1115,No,-,2 +T1565.001,No,-,2 +T1080,No,-,2 +T1218.007,No,-,2 +T1213.002,No,-,2 +T1195.002,No,-,2 +T1210,No,-,2 +T1087.003,No,-,2 +T1055.002,No,-,2 +T1222.002,No,-,2 +T1492,No,-,2 +T1032,No,-,2 +T1176,No,-,2 +T1187,No,-,2 +T1109,No,-,2 +T1134.002,No,-,2 +T1480.001,No,-,2 +T1037.001,No,-,2 +T1191,No,-,2 +T1560.002,No,-,2 +T1114.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 T1568.001,No,-,1 -T1123,No,-,1 -T1137.001,No,-,1 -T1528,No,-,1 -T1056.004,No,-,1 T1146,No,-,1 -T1546.012,No,-,1 -T1056.002,No,-,1 -T1573,No,-,1 -T1543.002,No,-,1 -T1053.003,No,-,1 -T1534,No,-,1 -T1483,No,-,1 -T1546.009,No,-,1 -T1574.012,No,-,1 -T1552.004,No,-,1 -T1546.015,No,-,1 -T1001.003,No,-,1 -T1218.008,No,-,1 -T1090.004,No,-,1 -T1182,No,-,1 -T1574.006,No,-,1 -T1174,No,-,1 -T1546.013,No,-,1 -T1564.004,No,-,1 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 -T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 -T1001.001,No,-,1 -T1030,No,-,1 -T1568.003,No,-,1 -T1122,No,-,1 -T1565.003,No,-,1 -T1220,No,-,1 -T1489,No,-,1 -T1550.001,No,-,1 -T1556.002,No,-,1 -T1010,No,-,1 -T1102.003,No,-,1 -T1482,No,-,1 -T1497.002,No,-,1 -T1200,No,-,1 -T1527,No,-,1 -T1494,No,-,1 -T1070.003,No,-,1 -T1096,No,-,1 -T1214,No,-,1 -T1021.006,No,-,1 -T1488,No,-,1 -T1055.013,No,-,1 -T1134.001,No,-,1 -T1021.005,No,-,1 -T1138,No,-,1 -T1026,No,-,1 -T1070.005,No,-,1 -T1037,No,-,1 -T1565.002,No,-,1 -T1568.002,No,-,1 -T1098.002,No,-,1 -T1137.004,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 T1036.001,No,-,1 -T1092,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 T1497.001,No,-,1 T1552.002,No,-,1 -T1491.001,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 T1137.006,No,-,1 -T1127.001,No,-,1 -T1145,No,-,1 -T1552.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 +T1568.001,No,-,1 +T1146,No,-,1 +T1504,No,-,1 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2 +T1546.011,Yes,https://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2 +T1036.001,No,-,1 +T1546.009,No,-,1 +T1501,No,-,1 +T1552.004,No,-,1 +T1183,No,-,1 +T1200,No,-,1 +T1552.006,No,-,1 +T1211,No,-,1 +T1070.005,No,-,1 +T1052.001,No,-,1 +T1056.004,No,-,1 +T1001.003,No,-,1 +T1001.001,No,-,1 +T1497.001,No,-,1 +T1552.002,No,-,1 +T1102.003,No,-,1 +T1218.008,No,-,1 +T1042,No,-,1 +T1216.001,No,-,1 +T1126,No,-,1 +T1098.002,No,-,1 +T1137.002,No,-,1 +T1172,No,-,1 +T1182,No,-,1 +T1527,No,-,1 +T1220,No,-,1 +T1092,No,-,1 +T1137.006,No,-,1 +T1562.002,No,-,1 +T1561.001,No,-,1 +T1565.002,No,-,1 +T1053.003,No,-,1 +T1489,No,-,1 +T1558.001,No,-,1 +T1214,No,-,1 +T1556.002,No,-,1 +T1186,No,-,1 +T1543.002,No,-,1 +T1028,No,-,1 +T1010,No,-,1 +T1565.003,No,-,1 +T1090.004,No,-,1 +T1137.001,No,-,1 +T1070.003,No,-,1 +T1482,No,-,1 +T1123,No,-,1 +T1021.005,No,-,1 +T1574.006,No,-,1 +T1534,No,-,1 +T1494,No,-,1 +T1491.001,No,-,1 +T1056.002,No,-,1 +T1568.003,No,-,1 +T1528,No,-,1 +T1145,No,-,1 +T1493,No,-,1 +T1546.001,Yes,https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0 +T1550.001,No,-,1 +T1568.002,No,-,1 +T1070.002,No,-,1 +T1574.012,No,-,1 +T1564.004,No,-,1 +T1055.013,No,-,1 +T1546.012,No,-,1 +T1127.001,No,-,1 +T1122,No,-,1 +T1488,No,-,1 +T1096,No,-,1 +T1546.015,No,-,1 +T1174,No,-,1 +T1134.001,No,-,1 +T1030,No,-,1 +T1137.004,No,-,1 +T1483,No,-,1 +T1497.002,No,-,1 +T1138,No,-,1 +T1546.013,No,-,1 +T1026,No,-,1 +T1021.006,No,-,1 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-12 +T1078.004,Yes,https://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml,-12 diff --git a/docs/mitre-map/detections.json b/docs/mitre-map/detections.json index 1613403cdc..21b4bfad81 100644 --- a/docs/mitre-map/detections.json +++ b/docs/mitre-map/detections.json @@ -5,1309 +5,440644 @@ "domain": "mitre-enterprise", "techniques": [ { - "techniqueID": "T1566.001", - "score": 49, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml" + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + }, + { + "techniqueID": "T1027", + "score": 52, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" }, { "techniqueID": "T1193", - "score": 51 + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" + }, + { + "techniqueID": "T1193", + "score": 51, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.001", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_oulook_exe_writing_a__zip_file.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_email_attachment_extensions.yml" }, { "techniqueID": "T1204.002", "score": 49, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" }, { - "techniqueID": "T1027", - "score": 47, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___encoded_command.yml" + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" }, { - "techniqueID": "T1086", - "score": 44 + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" + }, + { + "techniqueID": "T1204.002", + "score": 49, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/uncommon_processes_on_endpoint.yml" }, { "techniqueID": "T1059.001", "score": 36, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.001", + "score": 36, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1086", + "score": 44, + "showSubtechniques": true }, { "techniqueID": "T1059.003", "score": 34, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" + }, + { + "techniqueID": "T1059.003", + "score": 34, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml" }, { "techniqueID": "T1105", - "score": 40 + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true + }, + { + "techniqueID": "T1105", + "score": 40, + "showSubtechniques": true }, { "techniqueID": "T1060", - "score": 38 + "score": 38, + "showSubtechniques": true }, { "techniqueID": "T1547.001", "score": 35, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" + }, + { + "techniqueID": "T1060", + "score": 38, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.001", + "score": 35, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, { "techniqueID": "T1071.001", "score": 32, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { - "techniqueID": "T1107", - "score": 30 + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1071.001", + "score": 32, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/tor_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1070.004", - "score": 30 + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.004", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1107", + "score": 30, + "showSubtechniques": true + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", "score": 24, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" + }, + { + "techniqueID": "T1078", + "score": 27, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + }, + { + "techniqueID": "T1053.005", + "score": 24, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml" }, { "techniqueID": "T1003.001", "score": 20, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" + }, + { + "techniqueID": "T1003.001", + "score": 20, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml" }, { "techniqueID": "T1059.005", - "score": 26 + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.005", + "score": 26, + "showSubtechniques": true }, { "techniqueID": "T1082", "score": 23, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" }, { - "techniqueID": "T1078", + "techniqueID": "T1082", "score": 23, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" + }, + { + "techniqueID": "T1082", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/web_servers_executing_suspicious_processes.yml" }, { "techniqueID": "T1192", - "score": 24 + "score": 24, + "showSubtechniques": true }, { "techniqueID": "T1566.002", "score": 23, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1192", + "score": 24, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.002", + "score": 23, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_lnk_file_launching_a_process.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, { "techniqueID": "T1203", "score": 21, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" }, { "techniqueID": "T1083", - "score": 23 + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" + }, + { + "techniqueID": "T1083", + "score": 23, + "showSubtechniques": true + }, + { + "techniqueID": "T1203", + "score": 21, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml" }, { "techniqueID": "T1005", - "score": 22 - }, - { - "techniqueID": "T1016", - "score": 22 + "score": 22, + "showSubtechniques": true }, { "techniqueID": "T1057", - "score": 22 + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1005", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1057", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1016", + "score": 22, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true + }, + { + "techniqueID": "T1055", + "score": 21, + "showSubtechniques": true }, { "techniqueID": "T1076", - "score": 20 + "score": 20, + "showSubtechniques": true }, { "techniqueID": "T1021.001", "score": 16, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" }, { "techniqueID": "T1056.001", - "score": 20 + "score": 20, + "showSubtechniques": true }, { - "techniqueID": "T1018", - "score": 19 + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1076", + "score": 20, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.001", + "score": 16, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_desktop_network_bruteforce.yml" + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": true }, { "techniqueID": "T1140", - "score": 19 + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true }, { "techniqueID": "T1204.001", - "score": 19 + "score": 19, + "showSubtechniques": true }, { "techniqueID": "T1036.005", - "score": 19 + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1140", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1018", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1204.001", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.005", + "score": 19, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true }, { "techniqueID": "T1033", - "score": 18 + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1059", + "score": 18, + "showSubtechniques": true + }, + { + "techniqueID": "T1033", + "score": 18, + "showSubtechniques": true }, { "techniqueID": "T1189", - "score": 17 + "score": 17, + "showSubtechniques": true }, { "techniqueID": "T1047", "score": 11, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1189", + "score": 17, + "showSubtechniques": true + }, + { + "techniqueID": "T1047", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_temporary_event_subscription.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1003", + "score": 17, + "showSubtechniques": true }, { "techniqueID": "T1560.001", - "score": 16 - }, - { - "techniqueID": "T1043", - "score": 16 + "score": 16, + "showSubtechniques": true }, { "techniqueID": "T1543.003", "score": 15, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1555.003", - "score": 15 + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true }, { - "techniqueID": "T1503", - "score": 15 + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.001", + "score": 16, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.003", + "score": 15, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + }, + { + "techniqueID": "T1043", + "score": 16, + "showSubtechniques": true }, { "techniqueID": "T1112", "score": 13, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1112", + "score": 13, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_reg_exe_process.yml" + }, + { + "techniqueID": "T1555.003", + "score": 15, + "showSubtechniques": true + }, + { + "techniqueID": "T1503", + "score": 15, + "showSubtechniques": true + }, { "techniqueID": "T1049", - "score": 14 + "score": 14, + "showSubtechniques": true }, { "techniqueID": "T1136.001", "score": 11, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml" - }, - { - "techniqueID": "T1553.002", - "score": 14 - }, - { - "techniqueID": "T1074.001", - "score": 14 + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" }, { "techniqueID": "T1087.001", - "score": 14 + "score": 14, + "showSubtechniques": true }, { "techniqueID": "T1116", - "score": 14 + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1049", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.001", + "score": 11, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/short_lived_windows_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_local_admin_account.yml" + }, + { + "techniqueID": "T1087.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1116", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.001", + "score": 14, + "showSubtechniques": true + }, + { + "techniqueID": "T1553.002", + "score": 14, + "showSubtechniques": true }, { "techniqueID": "T1046", - "score": 13 + "score": 13, + "showSubtechniques": true }, { - "techniqueID": "T1113", - "score": 12 + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true }, { - "techniqueID": "T1045", - "score": 12 + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true + }, + { + "techniqueID": "T1046", + "score": 13, + "showSubtechniques": true }, { "techniqueID": "T1027.002", - "score": 12 + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true }, { "techniqueID": "T1041", - "score": 12 + "score": 12, + "showSubtechniques": true }, { - "techniqueID": "T1218.011", - "score": 10, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.002", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1113", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": true + }, + { + "techniqueID": "T1045", + "score": 12, + "showSubtechniques": true }, { "techniqueID": "T1021.002", "score": 9, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml" - }, - { - "techniqueID": "T1063", - "score": 11 - }, - { - "techniqueID": "T1073", - "score": 11 - }, - { - "techniqueID": "T1133", - "score": 11 + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" }, { "techniqueID": "T1574.002", - "score": 11 - }, - { - "techniqueID": "T1518.001", - "score": 11 - }, - { - "techniqueID": "T1059", - "score": 11 + "score": 11, + "showSubtechniques": true }, { "techniqueID": "T1085", - "score": 11 + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true }, { "techniqueID": "T1571", - "score": 11 + "score": 11, + "showSubtechniques": true }, { - "techniqueID": "T1505.003", - "score": 10 + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" }, { - "techniqueID": "T1087.002", - "score": 10 + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" }, { - "techniqueID": "T1136.002", - "score": 10 + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true }, { - "techniqueID": "T1055", - "score": 10 + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" + }, + { + "techniqueID": "T1021.002", + "score": 9, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/smb_traffic_spike___mltk.yml" + }, + { + "techniqueID": "T1574.002", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1085", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1073", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.011", + "score": 10, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + }, + { + "techniqueID": "T1133", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1518.001", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1063", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1571", + "score": 11, + "showSubtechniques": true + }, + { + "techniqueID": "T1036", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml" }, { "techniqueID": "T1100", - "score": 10 + "score": 10, + "showSubtechniques": true }, { - "techniqueID": "T1559.002", - "score": 9 + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1505.003", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1555", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1136.002", + "score": 10, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true }, { "techniqueID": "T1068", "score": 7, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml" - }, - { - "techniqueID": "T1564.003", - "score": 9 - }, - { - "techniqueID": "T1560", - "score": 9 - }, - { - "techniqueID": "T1143", - "score": 9 - }, - { - "techniqueID": "T1173", - "score": 9 - }, - { - "techniqueID": "T1090.002", - "score": 9 - }, - { - "techniqueID": "T1003", - "score": 9 + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" }, { "techniqueID": "T1562.001", "score": 7, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, { "techniqueID": "T1119", - "score": 9 + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1119", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1068", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml" + }, + { + "techniqueID": "T1562.001", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/attempt_to_stop_security_service.yml" + }, + { + "techniqueID": "T1090", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": true + }, + { + "techniqueID": "T1110", + "score": 9, + "showSubtechniques": true }, { "techniqueID": "T1218.010", - "score": 8 + "score": 8, + "showSubtechniques": true }, { - "techniqueID": "T1035", - "score": 8 + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true }, { "techniqueID": "T1219", - "score": 8 - }, - { - "techniqueID": "T1569.002", - "score": 7, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8 - }, - { - "techniqueID": "T1102.002", - "score": 8 - }, - { - "techniqueID": "T1071.004", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" - }, - { - "techniqueID": "T1135", - "score": 8 + "score": 8, + "showSubtechniques": true }, { "techniqueID": "T1190", "score": 6, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, { "techniqueID": "T1117", - "score": 8 + "score": 8, + "showSubtechniques": true }, { - "techniqueID": "T1548.002", - "score": 8 - }, - { - "techniqueID": "T1065", - "score": 8 + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true }, { "techniqueID": "T1003.004", - "score": 8 + "score": 8, + "showSubtechniques": true }, { - "techniqueID": "T1027.005", - "score": 7 + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true }, { - "techniqueID": "T1106", - "score": 7 + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true }, { - "techniqueID": "T1066", - "score": 7 + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true }, { - "techniqueID": "T1007", - "score": 7 + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true }, { - "techniqueID": "T1059.007", - "score": 7 + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.010", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1548.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1190", + "score": 6, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_f5_tmui_rct_cve_2020_5902.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/sql_injection_with_long_urls.yml" + }, + { + "techniqueID": "T1071.004", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/dns_record_changed.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/excessive_dns_failures.yml" + }, + { + "techniqueID": "T1035", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/first_time_seen_running_windows_service.yml" + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1135", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.002", + "score": 8, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true }, { "techniqueID": "T1070.001", "score": 5, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" }, { - "techniqueID": "T1573.001", - "score": 7 + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true }, { - "techniqueID": "T1023", - "score": 7 + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true }, { - "techniqueID": "T1552.001", - "score": 7 - }, - { - "techniqueID": "T1555", - "score": 7 - }, - { - "techniqueID": "T1547.009", - "score": 7 - }, - { - "techniqueID": "T1221", - "score": 7 - }, - { - "techniqueID": "T1069.002", - "score": 7 - }, - { - "techniqueID": "T1021.004", - "score": 7 + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true }, { "techniqueID": "T1012", - "score": 7 + "score": 7, + "showSubtechniques": true }, { - "techniqueID": "T1009", - "score": 6 + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1023", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1071", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.004", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1221", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.001", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/windows_event_log_cleared.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_wevtutil_usage.yml" + }, + { + "techniqueID": "T1098", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.005", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1106", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1012", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.001", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1066", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.007", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1102", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.002", + "score": 7, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true }, { "techniqueID": "T1114.002", "score": 4, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" }, { "techniqueID": "T1048.003", "score": 4, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true }, { "techniqueID": "T1003.002", "score": 5, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, { "techniqueID": "T1036.004", - "score": 6 + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" }, { "techniqueID": "T1027.001", - "score": 6 + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1074.002", - "score": 5 + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1218.005", - "score": 5 - }, - { - "techniqueID": "T1566.003", + "techniqueID": "T1114.002", "score": 4, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" }, { - "techniqueID": "T1059.006", - "score": 5 - }, - { - "techniqueID": "T1223", - "score": 5 - }, - { - "techniqueID": "T1573.002", - "score": 5 - }, - { - "techniqueID": "T1099", - "score": 5 - }, - { - "techniqueID": "T1055.001", - "score": 5 - }, - { - "techniqueID": "T1120", - "score": 5 - }, - { - "techniqueID": "T1218.001", - "score": 5 - }, - { - "techniqueID": "T1550.002", + "techniqueID": "T1048.003", "score": 4, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" }, { - "techniqueID": "T1564.001", - "score": 5 + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1546.003", - "score": 5 + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1027.003", - "score": 5 + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1546.008", + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", "score": 4, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" }, { - "techniqueID": "T1001.002", - "score": 5 + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" }, { - "techniqueID": "T1040", - "score": 5 + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1070.006", - "score": 5 + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1084", - "score": 5 + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1015", - "score": 5 + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" }, { - "techniqueID": "T1194", - "score": 5 + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1075", - "score": 5 + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true }, { - "techniqueID": "T1110", - "score": 5 + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" }, { - "techniqueID": "T1090", - "score": 5 + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" }, { - "techniqueID": "T1036", - "score": 0, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1037", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/email_servers_sending_high_volume_traffic_to_hosts.yml" + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/protocol_or_port_mismatch.yml" + }, + { + "techniqueID": "T1134", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.004", + "score": 6, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.002", + "score": 5, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + }, + { + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": true }, { "techniqueID": "T1158", - "score": 5 + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1170", - "score": 5 + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true }, { "techniqueID": "T1562.004", "score": 4, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, { "techniqueID": "T1102.001", - "score": 5 + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1102", - "score": 4 + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1003.005", - "score": 4 + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1124", - "score": 4 + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1570", - "score": 4 + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1014", - "score": 4 + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" }, { - "techniqueID": "T1025", - "score": 4 + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1487", - "score": 4 + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1496", - "score": 4 + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1574.001", - "score": 4 + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1036.002", - "score": 4 + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1036.003", - "score": 4 + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" }, { - "techniqueID": "T1071.002", - "score": 3, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1093", - "score": 4 + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1094", - "score": 4 + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1055.012", - "score": 4 + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" }, { - "techniqueID": "T1561.002", - "score": 4 + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true }, { - "techniqueID": "T1038", - "score": 4 + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1069", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.004", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/processes_launching_netsh.yml" + }, + { + "techniqueID": "T1099", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.005", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1170", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1074.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.002", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1566.003", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + }, + { + "techniqueID": "T1070.006", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1027.003", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.001", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1194", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1084", + "score": 5, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.002", + "score": 4, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml" }, { "techniqueID": "T1078.003", "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true }, { "techniqueID": "T1560.003", - "score": 4 + "score": 4, + "showSubtechniques": true }, { - "techniqueID": "T1110.002", - "score": 3 + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.003", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1518", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.002", + "score": 3, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_outbound_smb_traffic.yml" + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1036.003", + "score": 4, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true }, { "techniqueID": "T1020", - "score": 3 + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true }, { "techniqueID": "T1053.002", - "score": 3 + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1485", - "score": 2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true }, { "techniqueID": "T1072", "score": 2, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" }, - { - "techniqueID": "T1027.004", - "score": 3 - }, - { - "techniqueID": "T1090.003", - "score": 3 - }, { "techniqueID": "T1542.003", - "score": 3 - }, - { - "techniqueID": "T1008", - "score": 3 - }, - { - "techniqueID": "T1529", - "score": 3 + "score": 3, + "showSubtechniques": true }, { "techniqueID": "T1069.001", - "score": 3 + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1097", - "score": 3 + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1197", - "score": 3 - }, - { - "techniqueID": "T1104", - "score": 3 - }, - { - "techniqueID": "T1110.003", - "score": 3 + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true }, { "techniqueID": "T1095", "score": 2, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" }, { - "techniqueID": "T1188", - "score": 3 + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1039", - "score": 3 - }, - { - "techniqueID": "T1550.003", - "score": 3 - }, - { - "techniqueID": "T1572", - "score": 3 - }, - { - "techniqueID": "T1486", - "score": 3 - }, - { - "techniqueID": "T1500", - "score": 3 - }, - { - "techniqueID": "T1071.003", - "score": 3 - }, - { - "techniqueID": "T1518", - "score": 3 + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true }, { "techniqueID": "T1078.002", "score": 2, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" }, { - "techniqueID": "T1071", - "score": 3 + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true }, { "techniqueID": "T1067", - "score": 3 + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" }, { "techniqueID": "T1091", - "score": 3 + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1098", - "score": 3 + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1176", - "score": 2 + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1187", - "score": 2 + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1032", - "score": 2 + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1137", - "score": 2 + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" }, { - "techniqueID": "T1564.005", - "score": 2 + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1210", - "score": 2 + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1559.001", - "score": 2 + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1080", - "score": 2 + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1560.002", - "score": 2 + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1115", - "score": 2 + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1218.007", - "score": 2 + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1542.002", - "score": 2 + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1547.004", - "score": 2 + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1199", - "score": 2 + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1087.003", - "score": 2 + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1090.001", - "score": 2 + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1218.003", - "score": 2 + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1037.001", - "score": 2 + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" }, { - "techniqueID": "T1222.002", - "score": 2 + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1567.002", - "score": 2 + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1134.002", - "score": 2 + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true }, { - "techniqueID": "T1191", - "score": 2 + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1213", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1020", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detection_of_tools_built_by_nirsoft.yml" + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1486", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1095", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.002", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/identify_new_user_accounts.yml" + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1485", + "score": 2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/deleting_shadow_copies.yml" + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1039", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1110.002", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": true + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": true }, { "techniqueID": "T1003.003", "score": -2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml" - }, - { - "techniqueID": "T1213.002", - "score": 2 - }, - { - "techniqueID": "T1492", - "score": 2 + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" }, { "techniqueID": "T1201", - "score": 2 + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1125", - "score": 2 + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1565.001", - "score": 2 + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1004", - "score": 2 + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1055.002", - "score": 2 + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1109", - "score": 2 + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1195.002", - "score": 2 - }, - { - "techniqueID": "T1069", - "score": 2 + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true }, { "techniqueID": "T1059.004", - "score": 2 + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true }, { "techniqueID": "T1480.001", - "score": 2 + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1501", - "score": 1 + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1070.002", - "score": 1 + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1558.001", - "score": 1 + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true }, { - "techniqueID": "T1195", - "score": 1 + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" }, { - "techniqueID": "T1042", - "score": 1 + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/creation_of_shadow_copy.yml" + }, + { + "techniqueID": "T1201", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1547.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1004", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1080", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1195.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": true + }, + { + "techniqueID": "T1114.001", + "score": 1, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true }, { "techniqueID": "T1546.011", "score": -2, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true }, { "techniqueID": "T1183", - "score": 1 + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true }, { "techniqueID": "T1493", - "score": 1 + "score": 1, + "showSubtechniques": true }, { "techniqueID": "T1546.001", "score": 0, + "showSubtechniques": true, "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" }, { - "techniqueID": "T1561.001", - "score": 1 + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1562.002", - "score": 1 + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1186", - "score": 1 - }, - { - "techniqueID": "T1134", - "score": 1 - }, - { - "techniqueID": "T1126", - "score": 1 - }, - { - "techniqueID": "T1074", - "score": 1 - }, - { - "techniqueID": "T1001", - "score": 1 - }, - { - "techniqueID": "T1172", - "score": 1 - }, - { - "techniqueID": "T1504", - "score": 1 - }, - { - "techniqueID": "T1213", - "score": 1 - }, - { - "techniqueID": "T1216.001", - "score": 1 - }, - { - "techniqueID": "T1052.001", - "score": 1 - }, - { - "techniqueID": "T1211", - "score": 1 - }, - { - "techniqueID": "T1137.002", - "score": 1 - }, - { - "techniqueID": "T1568.001", - "score": 1 - }, - { - "techniqueID": "T1123", - "score": 1 - }, - { - "techniqueID": "T1137.001", - "score": 1 - }, - { - "techniqueID": "T1528", - "score": 1 - }, - { - "techniqueID": "T1056.004", - "score": 1 - }, - { - "techniqueID": "T1146", - "score": 1 - }, - { - "techniqueID": "T1546.012", - "score": 1 - }, - { - "techniqueID": "T1056.002", - "score": 1 - }, - { - "techniqueID": "T1573", - "score": 1 - }, - { - "techniqueID": "T1543.002", - "score": 1 - }, - { - "techniqueID": "T1053.003", - "score": 1 - }, - { - "techniqueID": "T1534", - "score": 1 - }, - { - "techniqueID": "T1483", - "score": 1 - }, - { - "techniqueID": "T1546.009", - "score": 1 + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true }, { "techniqueID": "T1574.012", - "score": 1 - }, - { - "techniqueID": "T1552.004", - "score": 1 - }, - { - "techniqueID": "T1546.015", - "score": 1 - }, - { - "techniqueID": "T1001.003", - "score": 1 - }, - { - "techniqueID": "T1218.008", - "score": 1 - }, - { - "techniqueID": "T1090.004", - "score": 1 - }, - { - "techniqueID": "T1182", - "score": 1 - }, - { - "techniqueID": "T1574.006", - "score": 1 - }, - { - "techniqueID": "T1174", - "score": 1 - }, - { - "techniqueID": "T1546.013", - "score": 1 + "score": 1, + "showSubtechniques": true }, { "techniqueID": "T1564.004", - "score": 1 + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true }, { "techniqueID": "T1078.004", "score": -12, - "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml" + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" }, { - "techniqueID": "T1001.001", - "score": 1 + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1030", - "score": 1 + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1568.003", - "score": 1 + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1122", - "score": 1 - }, - { - "techniqueID": "T1565.003", - "score": 1 - }, - { - "techniqueID": "T1220", - "score": 1 - }, - { - "techniqueID": "T1489", - "score": 1 - }, - { - "techniqueID": "T1550.001", - "score": 1 - }, - { - "techniqueID": "T1556.002", - "score": 1 - }, - { - "techniqueID": "T1010", - "score": 1 - }, - { - "techniqueID": "T1102.003", - "score": 1 - }, - { - "techniqueID": "T1482", - "score": 1 - }, - { - "techniqueID": "T1497.002", - "score": 1 - }, - { - "techniqueID": "T1200", - "score": 1 - }, - { - "techniqueID": "T1527", - "score": 1 - }, - { - "techniqueID": "T1494", - "score": 1 - }, - { - "techniqueID": "T1070.003", - "score": 1 - }, - { - "techniqueID": "T1096", - "score": 1 - }, - { - "techniqueID": "T1214", - "score": 1 - }, - { - "techniqueID": "T1021.006", - "score": 1 - }, - { - "techniqueID": "T1488", - "score": 1 - }, - { - "techniqueID": "T1055.013", - "score": 1 - }, - { - "techniqueID": "T1134.001", - "score": 1 - }, - { - "techniqueID": "T1021.005", - "score": 1 - }, - { - "techniqueID": "T1138", - "score": 1 - }, - { - "techniqueID": "T1026", - "score": 1 - }, - { - "techniqueID": "T1070.005", - "score": 1 - }, - { - "techniqueID": "T1037", - "score": 1 - }, - { - "techniqueID": "T1565.002", - "score": 1 - }, - { - "techniqueID": "T1568.002", - "score": 1 - }, - { - "techniqueID": "T1098.002", - "score": 1 - }, - { - "techniqueID": "T1137.004", - "score": 1 + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" }, { "techniqueID": "T1036.001", - "score": 1 + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1092", - "score": 1 + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1497.001", - "score": 1 + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1552.002", - "score": 1 + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1491.001", - "score": 1 + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true }, { - "techniqueID": "T1137.006", - "score": 1 - }, - { - "techniqueID": "T1127.001", - "score": 1 - }, - { - "techniqueID": "T1145", - "score": 1 + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true }, { "techniqueID": "T1552.006", - "score": 1 + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true }, { "techniqueID": "T1028", - "score": 1 + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" + }, + { + "techniqueID": "T1568.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1146", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1504", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.011", + "score": -2, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/shim_database_file_creation.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml" + }, + { + "techniqueID": "T1036.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.009", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1501", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1183", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1200", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1211", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1052.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1001.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1552.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1102.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1218.008", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1042", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1216.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1126", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1098.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1172", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1182", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1527", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1220", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1092", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1562.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1561.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1053.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1558.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1214", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1556.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1186", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1543.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1028", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1010", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1565.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1090.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1482", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1123", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.005", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1534", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1494", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1491.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1056.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.003", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1528", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1145", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1493", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.001", + "score": 0, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/suspicious_changes_to_file_associations.yml" + }, + { + "techniqueID": "T1550.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1568.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1070.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1574.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1564.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1055.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.012", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1127.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1122", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1488", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1096", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.015", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1174", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1134.001", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1030", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1137.004", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1483", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1497.002", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1138", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1546.013", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1026", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1021.006", + "score": 1, + "showSubtechniques": true + }, + { + "techniqueID": "T1078.004", + "score": -12, + "showSubtechniques": true, + "comment": "https://github.com/splunk/security-content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security-content/blob/develop/detections/aws_cross_account_activity_from_previously_unseen_account.yml" } ], "gradient": { diff --git a/docs/mitre-map/priority.png b/docs/mitre-map/priority.png index 48c40a38d4..6622f39206 100644 Binary files a/docs/mitre-map/priority.png and b/docs/mitre-map/priority.png differ diff --git a/macros/cisco_networks.yml b/macros/cisco_networks.yml new file mode 100644 index 0000000000..3c2e8c0a1e --- /dev/null +++ b/macros/cisco_networks.yml @@ -0,0 +1,4 @@ +definition: eventtype=cisco_ios +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: cisco_networks diff --git a/macros/detect_arp_poisoning_filter.yml b/macros/detect_arp_poisoning_filter.yml new file mode 100644 index 0000000000..93706055bb --- /dev/null +++ b/macros/detect_arp_poisoning_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Use this macro to add additional filters to prevent i.e. false positives +name: detect_arp_poisoning_filter diff --git a/macros/detect_rogue_dhcp_server_filter.yml b/macros/detect_rogue_dhcp_server_filter.yml new file mode 100644 index 0000000000..accfe2bbaf --- /dev/null +++ b/macros/detect_rogue_dhcp_server_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Use this macro to add additional filters to prevent i.e. false positives +name: detect_rogue_dhcp_server_filter diff --git a/macros/security_content_ctime.yml b/macros/security_content_ctime.yml index 716c440c77..3c18a1d7af 100644 --- a/macros/security_content_ctime.yml +++ b/macros/security_content_ctime.yml @@ -1,5 +1,5 @@ arguments: - field -definition: 'convert timeformat="%m/%d/%Y %H:%M:%S" ctime($field$)' +definition: 'convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)' description: convert epoch time to string name: security_content_ctime diff --git a/requirements.txt b/requirements.txt index 4e899d2a3d..bc73eba932 100644 --- a/requirements.txt +++ b/requirements.txt @@ -11,7 +11,7 @@ contextlib2==0.6.0.post1 distlib==0.3.1 filelock==3.0.12 gitdb==4.0.5 -identify==1.4.28 +identify==1.4.29 idna==2.10 importlib-metadata==1.7.0 importlib-resources==3.0.0 @@ -21,7 +21,7 @@ MarkupSafe==1.1.1 more-itertools==8.4.0 nodeenv==1.5.0 pathlib2==2.3.5 -pre-commit==2.6.0 +pre-commit==2.7.1 pyrsistent==0.16.0 python-dateutil==2.8.1 pytz==2020.1 diff --git a/response_tasks/get_notable_info.yml b/response_tasks/get_notable_info.yml index 91a66fbd5d..e6aa2727cd 100644 --- a/response_tasks/get_notable_info.yml +++ b/response_tasks/get_notable_info.yml @@ -71,3 +71,4 @@ tags: - Kubernetes Sensitive Object Access Activity - F5 TMUI RCE CVE-2020-5902 - Windows DNS SIGRed CVE-2020-1350 + - Suspicious GCP Storage Activities diff --git a/stories/suspicious_gcp_storage_activities.yml b/stories/suspicious_gcp_storage_activities.yml new file mode 100644 index 0000000000..4024a43e26 --- /dev/null +++ b/stories/suspicious_gcp_storage_activities.yml @@ -0,0 +1,23 @@ +name: Suspicious GCP Storage Activities +id: 4d656b2e-d6be-11ea-87d0-0242ac130003 +version: 1 +date: '2020-08-05' +description: Use the searches in this Analytic Story to monitor your GCP Storage buckets + for evidence of anomalous activity and suspicious behaviors, such as detecting open + storage buckets and buckets being accessed from a new IP. The contextual and investigative + searches will give you more information, when required. +narrative: 'Similar to other cloud providers, GCP operates on a shared responsibility model. + This means the end user, you, are responsible for setting appropriate access control lists + and permissions on your GCP resources.\ + This Analytics Story concentrates on detecting things like open storage buckets (both read and write) + along with storage bucket access from unfamiliar users and IP addresses.' +author: Shannon Davis, Splunk +type: ESCU +references: +- https://cloud.google.com/blog/products/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security +- https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/ +tags: + analytics_story: Suspicious GCP Storage Activities + usecase: Security Monitoring + category: + - Cloud Security \ No newline at end of file